CVE-2023-25539

Vulnerability

The vulnerability is an OS command injection in the nsrcapinfo component of Dell NetWorker client versions 19.6.1.2 and earlier (including NVE versions 19.7.1 and prior). A remote unauthenticated attacker can send crafted input that is not properly sanitized before being passed to OS commands, leading to arbitrary command execution with the privileges of the vulnerable application [1].

Exploitation

An attacker does not need authentication or prior access to the system. The attack is network-based and requires no user interaction, as the vulnerable component is exposed to the network. By sending a specially crafted request to the nsrcapinfo component, the attacker can inject arbitrary OS commands that are executed by the application [1].

Impact

Successful exploitation allows the attacker to execute arbitrary OS commands on the underlying operating system with the privileges of the NetWorker client process. This can lead to complete compromise of the affected system, including unauthorized access, data exfiltration, and potential lateral movement within the network [1].

Mitigation

Dell has released fixed versions: NetWorker NVE version 19.8.0.1 and later, and corresponding updates for other affected versions. Users should upgrade to the remediated versions immediately. No workarounds are mentioned in the advisory; the only mitigation is to apply the official update [1].