Dell RecoverPoint for Virtual Machines up to 5.3 SP3 P2 excessive authentication

Summaryinfo

A vulnerability has been found in Dell RecoverPoint for Virtual Machines up to 5.3 SP3 P2 and classified as problematic. This issue affects some unknown processing. This manipulation causes excessive authentication. This vulnerability is registered as CVE-2024-22425. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in Dell RecoverPoint for Virtual Machines up to 5.3 SP3 P2 (Backup Software). It has been declared as problematic. Affected by this vulnerability is an unknown part. The manipulation with an unknown input leads to a excessive authentication vulnerability. The CWE definition for the vulnerability is CWE-307. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks. As an impact it is known to affect confidentiality. The summary by CVE is:

Dell RecoverPoint for Virtual Machines 5.3.x contains a brute force/dictionary attack vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to launch a brute force attack or a dictionary attack against the RecoverPoint login form. This allows attackers to brute-force the password of valid users in an automated manner.

The weakness was published 02/16/2024 as dsa-2024-092. The advisory is shared at dell.com. This vulnerability is known as CVE-2024-22425 since 01/10/2024. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 01/24/2025). MITRE ATT&CK project uses the attack technique T1110.001 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Backup Software

Vendor

• Dell

Name

• RecoverPoint for Virtual Machines

Version

• 5.3 SP2
• 5.3 SP2 P1
• 5.3 SP2 P2
• 5.3 SP2 P4
• 5.3 SP3 P1
• 5.3 SP3 P2

License

• commercial

Website

• Vendor: https://www.dell.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion