CVE-2020-5330

Vulnerability

CVE-2020-5330 is an information disclosure vulnerability present in multiple Dell EMC Networking firmware versions. Affected products include Dell EMC Networking X-Series firmware versions 3.0.1.2 and older, Dell EMC Networking PC5500 firmware versions 4.1.0.22 and older, and Dell EMC PowerEdge VRTX Switch Modules firmware versions 2.0.0.77 and older [1]. The vulnerability exists in the affected endpoints that process network requests, and no special configuration or user interaction is required to reach the vulnerable code path [1].

Exploitation

A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted request to the affected endpoints [1]. No authentication or prior access to the device is required, and the attack can be carried out over the network. The precise nature of the request or the endpoint involved is not detailed in the available references [1].

Impact

Successful exploitation allows the attacker to retrieve sensitive data from the affected device [1]. The CVSS v3.1 base score is 8.1 (High) with the vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a high impact on confidentiality, integrity, and availability, though the attack complexity is high [1]. The attacker gains no privileged access but can extract potentially sensitive information.

Mitigation

Dell Technologies has released firmware updates to address this vulnerability. For VRTX Series Switches, fixed versions include R1-2210 and R1-2401. For Dell PC5500 Series (X1000 and X4012), fixed versions are available (details in reference). For X-Series, updated firmware is also provided [1]. Users should update to the latest firmware version for their respective product to remediate the vulnerability.