« Volver al listado

CVE-2024-22425

Estado: AnalizadaCrítica (9.8)—

Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains a brute force/dictionary attack vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to launch a brute force attack or a dictionary attack against the RecoverPoint login form. This allows attackers to brute-force the password of valid users in an automated manner.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Dell — Recoverpoint FOR Virtual Machines

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-22425",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-22425",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-29T15:51:03.777802Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security_alert@emc.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Dell",
          "product": "RecoverPoint for VMs",
          "versions": [
            {
              "status": "affected",
              "version": "5.3 SP2"
            },
            {
              "status": "affected",
              "version": "5.3 SP2 P1"
            },
            {
              "status": "affected",
              "version": "5.3 SP2 P2"
            },
            {
              "status": "affected",
              "version": "5.3 SP2 P4"
            },
            {
              "status": "affected",
              "version": "5.3 SP3 P1"
            },
            {
              "status": "affected",
              "version": "5.3 SP3 P2"
            },
            {
              "status": "affected",
              "version": "6.0.SP1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:dell:recoverpoint_for_virtual_machines:*:*:*:*:*:*:*:*"
          ],
          "vendor": "dell",
          "product": "recoverpoint_for_virtual_machines",
          "versions": [
            {
              "status": "affected",
              "version": "5.3SP2"
            },
            {
              "status": "affected",
              "version": "5.3SP2P1"
            },
            {
              "status": "affected",
              "version": "5.3SP2P2"
            },
            {
              "status": "affected",
              "version": "5.3SP2P4"
            },
            {
              "status": "affected",
              "version": "5.3 SP3P1"
            },
            {
              "status": "affected",
              "version": "5.3 SP3P2"
            },
            {
              "status": "affected",
              "version": "6.0.SP1"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-02-16T12:15:07.757",
  "references": [
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000222133/dsa-2024-092-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000228154/dsa-2024-369-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000222133/dsa-2024-092-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security_alert@emc.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-307"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains a brute force/dictionary attack vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to launch a brute force attack or a dictionary attack against the RecoverPoint login form. This allows attackers to brute-force the password of valid users in an automated manner."
    },
    {
      "lang": "es",
      "value": "Dell RecoverPoint for Virtual Machines 5.3.x contiene una vulnerabilidad de ataque de fuerza bruta/diccionario. Un atacante remoto no autenticado podría explotar esta vulnerabilidad, lo que llevaría a lanzar un ataque de fuerza bruta o un ataque de diccionario contra el formulario de inicio de sesión de RecoverPoint. Esto permite a los atacantes forzar la contraseña de usuarios válidos de forma automatizada."
    }
  ],
  "lastModified": "2026-06-17T07:11:23.320",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dell:recoverpoint_for_virtual_machines:5.3:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D63758C-7150-4B89-BD05-08AAA2C3D018"
            },
            {
              "criteria": "cpe:2.3:a:dell:recoverpoint_for_virtual_machines:5.3:sp2_p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AE782786-D263-4946-8CDF-8FDA831FC6C9"
            },
            {
              "criteria": "cpe:2.3:a:dell:recoverpoint_for_virtual_machines:5.3:sp2_p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7494092A-686D-4AE7-B420-80586564FA27"
            },
            {
              "criteria": "cpe:2.3:a:dell:recoverpoint_for_virtual_machines:5.3:sp2_p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F113FDFF-78AC-4F85-82B6-A01F2DD12CAB"
            },
            {
              "criteria": "cpe:2.3:a:dell:recoverpoint_for_virtual_machines:5.3:sp3_p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE37056B-7198-4A83-8912-99DA65E6D889"
            },
            {
              "criteria": "cpe:2.3:a:dell:recoverpoint_for_virtual_machines:5.3:sp3_p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B31D991B-B2BB-4D75-AA16-B47A87D556FB"
            },
            {
              "criteria": "cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DD0ABCD5-9273-4799-A916-3518ED5EBB46"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}