CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-0167

Critical Severity
Dell
SVRS
70/100

CVSSv3
7.8/10

EPSS
0.00205/1

CVE-2024-0167 is a critical OS Command Injection vulnerability affecting Dell Unity systems. Prior to version 5.4, the svc_topstats utility allows an authenticated attacker to inject commands and overwrite arbitrary files with root privileges. Although the CVSS score is 7.8, the SOCRadar Vulnerability Risk Score (SVRS) is 70, indicating a significant risk that warrants attention. Successful exploitation grants an attacker full control over the affected Dell Unity system. This arbitrary file overwrite capability poses a serious threat to data integrity and system availability. The root privileges gained make this a high-impact vulnerability. Immediate patching is recommended to mitigate the risk of exploitation. The presence of the In The Wild tag further emphasizes the importance of addressing this CVE promptly.

In The Wild
CVSS:3.1
AV:L
AC:L
PR:L
UI:N
S:U
C:H
I:H
A:H
2024-02-12

2024-02-15

Indicators of Compromise

No IOCs found for this CVE

Exploits

No exploits found for this CVE

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

No news found for this CVE

Social Media

No tweets found for this CVE

Affected Software

Configuration 1
TypeVendorProduct
AppDellunity_operating_environment

References

ReferenceLink
[email protected]https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities

CWE Details

CWE IDCWE NameDescription
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence