Improper Restriction of Excessive Authentication Attempts in RecoverPoint for VMs - CVE-2024-22425

Vulnerability details

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to brute force/dictionary attack. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to launch a brute force attack or a dictionary attack against the RecoverPoint login form. This allows attackers to brute-force the password of valid users in an automated manner.

Affected software

How to mitigate CVE-2024-22425

External References

• https://www.dell.com/support/kbdoc/en-us/000222133/dsa-2024-092-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities
• https://www.dell.com/support/kbdoc/en-us/000228154/dsa-2024-369-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities

Related Security Bulletins

• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines