CVE-2024-22425 Auth bypass in RecoverPoint for VMs
Unauthenticated attackers can brute-force user passwords on the login form, potentially gaining unauthorized access to the system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-22425?
CVE-2024-22425 is a medium-severity authentication bypass vulnerability in Dell RecoverPoint for VMs, published on 16 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains a brute force/dictionary attack vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to launch a brute force attack or a dictionary attack against the RecoverPoint login form. This allows attackers to brute-force the password of valid users in an automated manner.
Weakness: CWE-307
Which versions are affected by CVE-2024-22425?
It affects 1 product.
Products include Dell Recoverpoint for Virtual Machines.
How do I fix CVE-2024-22425?
No fix has been published for CVE-2024-22425 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-22425 being exploited?
There is no known exploitation of CVE-2024-22425 in the wild and no public exploit code.
Other vulnerabilities in Dell RecoverPoint for VMs
- CVE-2026-22769 Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials
- CVE-2024-22461 Command injection in RecoverPoint for Virtual Machines
- CVE-2016-6650 Security feature bypass in EMC RecoverPoint versions prior to 5.0 and EMC RecoverPoint for Virtual Machines versions prior to 5.0
- CVE-2024-22426 Command injection in RecoverPoint for VMs
- CVE-2016-6649 Command injection in EMC RecoverPoint and EMC RecoverPoint for Virtual Machines EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoint for Virtual Machines versions before 5.0
Sources
Also known as GHSA-9m95-x9fm-78hh.