Dell PowerScale OneFS up to 9.4.0.16/9.5.0.5/9.6.1.0 risky encryption

Summaryinfo

A vulnerability marked as problematic has been reported in Dell PowerScale OneFS up to 9.4.0.16/9.5.0.5/9.6.1.0. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in risky encryption. This vulnerability is identified as CVE-2024-22463. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Dell PowerScale OneFS up to 9.4.0.16/9.5.0.5/9.6.1.0. It has been classified as problematic. This affects an unknown code. The manipulation with an unknown input leads to a risky encryption vulnerability. CWE is classifying the issue as CWE-327. The product uses a broken or risky cryptographic algorithm or protocol. This is going to have an impact on confidentiality. The summary by CVE is:

Dell PowerScale OneFS 8.2.x through 9.6.0.x contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unprivileged attacker could potentially exploit this vulnerability, leading to compromise of confidentiality and integrity of sensitive information

The weakness was released 03/04/2024 as dsa-2024-062. It is possible to read the advisory at dell.com. This vulnerability is uniquely identified as CVE-2024-22463 since 01/10/2024. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/08/2025). The attack technique deployed by this issue is T1600 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Dell

Name

• PowerScale OneFS

Version

• 9.4.0.0
• 9.4.0.1
• 9.4.0.2
• 9.4.0.3
• 9.4.0.4
• 9.4.0.5
• 9.4.0.6
• 9.4.0.7
• 9.4.0.8
• 9.4.0.9
• 9.4.0.10
• 9.4.0.11
• 9.4.0.12
• 9.4.0.13
• 9.4.0.14
• 9.4.0.15
• 9.4.0.16
• 9.5.0.0
• 9.5.0.1
• 9.5.0.2
• 9.5.0.3
• 9.5.0.4
• 9.5.0.5
• 9.6.0
• 9.6.1.0

License

• commercial

Website

• Vendor: https://www.dell.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion