CVE-2020-5350CWE-78

Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component

High · published April 15, 2020

CVSS v3.1
7.9
EPSS
2%
Percentile
80.3
In the wild
Unconfirmed
What it is

Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs that could lead to manipulation of passwords and execution of malicious commands on ACM component.

The record
Technical detail
CVSS v3.1
7.9 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.01975 · 80.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2020-04-15T18:00Z
EPSS history
Timeline
  • 15 APR 18:00Z
    Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component
    cvelistv5