CVE-2013-3595

Vulnerability

The Dell OpenManage web application version 2.5 Build 1.19 contains an improper input validation vulnerability (CWE-20) that causes a denial of service when an undocumented URL for OSPF functionality is requested. This URL is not accessible from the web application's normal links but exists in the firmware. The vulnerability affects Dell PowerConnect switches running firmware versions 3348 1.2.1.3, 3524p 2.0.0.48, and 5324 2.0.1.4 [1].

Exploitation

An attacker must have valid credentials to authenticate to the web management interface. Once authenticated, the attacker can directly request the undocumented OSPF URL via a crafted HTTP GET request. The request triggers a crash in the OpenManage web application, causing the entire switch to reset [1].

Impact

Successful exploitation results in a denial of service: the switch resets, temporarily losing network connectivity and management access. No code execution or data compromise is associated with this specific vulnerability [1].

Mitigation

No firmware update or patch has been disclosed in the available references. As a workaround, restrict access to the web management interface to trusted users only, and consider using network segmentation to limit exposure [1].