Dell Hybrid Client up to 1.7 System Files command injection
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 6.9 | $0-$5k | 0.00 |
Summary
A vulnerability marked as critical has been reported in Dell Hybrid Client up to 1.7. The affected element is an unknown function of the component System Files Handler. The manipulation leads to command injection. This vulnerability is uniquely identified as CVE-2022-34432. Local access is required to approach this attack. No exploit exists. It is suggested to upgrade the affected component.
Details
A vulnerability, which was classified as critical, has been found in Dell Hybrid Client up to 1.7. This issue affects an unknown code of the component System Files Handler. The manipulation with an unknown input leads to a command injection vulnerability. Using CWE to declare the problem leads to CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:
Dell Hybrid Client below 1.8 version contains a gedit vulnerability. A guest attacker could potentially exploit this vulnerability, allowing deletion of user and some system files and folders.
The weakness was disclosed 10/11/2022 as dsa-2022-260. The advisory is shared at dell.com. The identification of this vulnerability is CVE-2022-34432 since 06/23/2022. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1202 for this issue.
Upgrading to version 1.8 eliminates this vulnerability.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Product
Vendor
Name
Version
License
Website
- Vendor: https://www.dell.com/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.9VulDB Meta Temp Score: 6.9
VulDB Base Score: 5.3
VulDB Temp Score: 5.1
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 8.2
NVD Vector: 🔍
CNA Base Score: 7.3
CNA Vector (Dell): 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: Command injectionCWE: CWE-77 / CWE-74 / CWE-707
CAPEC: 🔍
ATT&CK: 🔍
Physical: Partially
Local: Yes
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: Hybrid Client 1.8
Timeline
06/23/2022 🔍10/11/2022 🔍
10/11/2022 🔍
11/06/2022 🔍
Sources
Vendor: dell.comAdvisory: dsa-2022-260
Status: Confirmed
CVE: CVE-2022-34432 (🔍)
GCVE (CVE): GCVE-0-2022-34432
GCVE (VulDB): GCVE-100-210557
Entry
Created: 10/11/2022 21:15Updated: 11/06/2022 09:30
Changes: 10/11/2022 21:15 (51), 11/06/2022 09:30 (11)
Complete: 🔍
Cache ID: 216::103
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
No comments yet. Languages: en.
Please log in to comment.