CVE-2024-45764

The vulnerability results from an error in the implementation of the authentication process — it lacks a critical step that should verify user identity before granting access. An attacker remotely, without having an account or password, can in certain circumstances (high attack complexity) bypass the protection mechanisms of the SONiC operating system. Successful exploitation of the vulnerability leads to a breach of security boundaries (scope changed), which indicates the possibility of impact beyond the direct component.

An attacker can bypass authentication mechanisms and system protection, which according to the CVSS vector results in complete loss of confidentiality, integrity, and availability of the attacked system. In practice, this means the possibility of taking control of an enterprise-class network device.

Dell recommends updating the system to a patched version as soon as possible. Detailed information about available patches and fixed versions can be found in the security bulletin DSA-2024-449 available at: https://www.dell.com/support/kbdoc/en-us/000245655/dsa-2024-449-security-update-for-dell-enterprise-sonic-distribution-vulnerabilities

Dell Enterprise SONiC OS in versions 4.1.x and 4.2.x