{"id":"CVE-2024-37140","state":"PUBLISHED","title":"Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection vulnerability in an admin operation. A remote low privileged ","description":"Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection vulnerability in an admin operation. A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the system application's underlying OS with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker.","publishedAt":"2024-06-26T03:54:38.461Z","updatedAt":"2024-08-02T03:50:54.530Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"dell"},"assigner":"dell","products":["Dell PowerProtect DD"],"affected":[{"vendor":"Dell","product":"PowerProtect DD","defaultStatus":"unaffected","versions":[{"version":"7.0","status":"affected","lessThanOrEqual":"7.13","versionType":"semver"},{"version":"N/A","status":"affected","lessThan":"2.7.7","versionType":"semver"},{"version":"N/A","status":"affected","lessThan":"5.16.0.0","versionType":"semver"}]}],"references":["https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:07:30.303Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/37xxx/CVE-2024-37140.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-37140","state":"PUBLISHED","datePublished":"2024-06-26T03:54:38.461Z","dateUpdated":"2024-08-02T03:50:54.530Z","assignerShortName":"dell","assignerOrgId":"c550e75a-17ff-4988-97f0-544cde3820fe","dateReserved":"2024-06-03T12:10:32.206Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection vulnerability in an admin operation. A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the system application's underlying OS with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker."}],"affected":[{"vendor":"Dell","product":"PowerProtect DD","defaultStatus":"unaffected","versions":[{"version":"7.0","status":"affected","lessThanOrEqual":"7.13","versionType":"semver"},{"version":"N/A","status":"affected","lessThan":"2.7.7","versionType":"semver"},{"version":"N/A","status":"affected","lessThan":"5.16.0.0","versionType":"semver"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"dell","orgId":"c550e75a-17ff-4988-97f0-544cde3820fe","dateUpdated":"2024-06-26T03:54:38.461Z"},"datePublic":"2024-06-24T06:30:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"dell","product":"powerprotect_dd","defaultStatus":"unknown","versions":[{"version":"7.0","status":"affected","lessThanOrEqual":"7.13","versionType":"semver"},{"version":"0","status":"affected","lessThan":"2.7.7","versionType":"semver"},{"version":"0","status":"affected","lessThan":"5.16.0.0","versionType":"semver"}],"cpes":["cpe:2.3:h:dell:powerprotect_dd:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-26T14:38:33.257609Z","id":"CVE-2024-37140","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-26T14:49:39.900Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T03:50:54.530Z"}}]}}}