CVE-2024-22426: Malicious File Upload
First published: Fri Feb 16 2024(Updated: )
Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains an OS Command injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to execute arbitrary operating system commands, which will get executed in the context of the root user, resulting in a complete system compromise.
Credit: security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| EMC RecoverPoint | >=5.3.0<6.0.SP1 | |
| EMC RecoverPoint | =5.3-sp2 | |
| EMC RecoverPoint | =5.3-sp2_p1 | |
| EMC RecoverPoint | =5.3-sp2_p2 | |
| EMC RecoverPoint | =5.3-sp2_p4 | |
| EMC RecoverPoint | =5.3-sp3_p1 | |
| EMC RecoverPoint | =5.3-sp3_p2 | |
| EMC RecoverPoint | =6.0-sp1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-22426?
CVE-2024-22426 has a high severity rating due to the potential for unauthenticated remote command execution by an attacker.
How do I fix CVE-2024-22426?
To fix CVE-2024-22426, update Dell RecoverPoint for Virtual Machines to the latest available patched version as recommended by Dell.
What are the affected versions in CVE-2024-22426?
CVE-2024-22426 affects Dell RecoverPoint for Virtual Machines versions 5.3.x through 6.0.SP1.
Can CVE-2024-22426 be exploited remotely?
Yes, CVE-2024-22426 can be exploited remotely by an unauthenticated attacker.
What are the risks associated with CVE-2024-22426?
The risks associated with CVE-2024-22426 include unauthorized execution of operating system commands with root privileges, which can lead to severe system compromise.
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/description
- agent/source
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- vendor/dell
- canonical/emc recoverpoint
- version/emc recoverpoint/5.3-sp2
- version/emc recoverpoint/5.3-sp2_p1
- version/emc recoverpoint/5.3-sp2_p2
- version/emc recoverpoint/5.3-sp2_p4
- version/emc recoverpoint/5.3-sp3_p1
- version/emc recoverpoint/5.3-sp3_p2
- version/emc recoverpoint/6.0-sp1