CVE-2021-36308

Vulnerability

Dell Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an authentication bypass vulnerability. The flaw resides in the Smart Fabric Services component and requires the service to be enabled. Affected versions include all releases before the October 2021 update [1].

Exploitation

A remote unauthenticated attacker can exploit this vulnerability by sending specially crafted requests to an affected OS10 system with Smart Fabric Services enabled. The attack does not require any prior authentication or user interaction, but the complexity of the attack is high (AV:N/AC:H) [1].

Impact

Successful exploitation allows the attacker to bypass authentication and perform actions on the affected system. According to the CVSS vector, the primary impact is on availability (high), with no impact on confidentiality or integrity (C:N/I:N/A:H) [1].

Mitigation

Dell has addressed this vulnerability in the October 2021 OS10 release. Users are advised to update to the latest version. No workarounds are provided in the advisory. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog [1].