7.4high
CVE-2018-15784
DSA-2019-001: Dell Networking OS10 Improper Certificate Validation Vulnerability
Published 7 y ago · modified 4 mo ago · JSON
CVSS
7.4
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 49%
Public exploits
0
none known
Summary
Dell Networking OS10 versions prior to 10.4.3.0 contain a vulnerability in the Phone Home feature which does not properly validate the server's certificate authority during TLS handshake. Use of an invalid or malicious certificate could potentially allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack.
Exploit prediction (EPSS)
0.61% probability of exploitation in the next 30 days, higher than 49% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 7.4 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| CNA | 3.0 | 7.4 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| NVD | 3.0 | 7.4 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
Affected products
- Dell Dell Networking OS10
Classification
- Weakness
- CWE-295 Improper Certificate Validation
References
- dell.com /support/article/us/en/04/sln315899/dsa-2019-001-dell-networking-os10-improper-certificate · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-15784
- NVD: CVE-2018-15784
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.