CVE-2023-32449

Vulnerability

Dell PowerStore versions prior to 3.5 contain an improper verification of cryptographic signature vulnerability. The software fails to properly validate cryptographic signatures on binaries, allowing a malicious binary to bypass existing checks. This affects all PowerStore versions before 3.5 [1].

Exploitation

An attacker must first gain access to a high-privileged user account on the PowerStore system. The attacker then tricks this user into installing a malicious binary, which bypasses the cryptographic signature verification due to the improper check. The attack requires user interaction from the high-privileged user [1].

Impact

Successful exploitation allows the attacker to install a malicious binary on the PowerStore system. This could lead to arbitrary code execution, system compromise, or further unauthorized actions within the affected environment [1].

Mitigation

Dell has released PowerStore version 3.5 which addresses this vulnerability. Users should upgrade to PowerStore 3.5 or later as soon as possible. No workarounds are documented in the available reference [1].