Untrusted search path in Virtual RAID on CPU (VROC) - CVE-2024-23489
Published: August 15, 2024
Vulnerability identifier: #VU96054
CSH Severity: Low
CVSS v4: 5.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-23489
CWE-ID: CWE-426
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to usage of an untrusted search path. A local user can place a malicious binary into a specific location on the system and execute arbitrary code with escalated privileges.
Affected software
Virtual RAID on CPU (VROC)
Precision 5860 Tower
Precision 7960 Tower
Precision 7960 Rack
Precision 5860 Tower
Precision 7960 Tower
Precision 7960 Rack
How to mitigate CVE-2024-23489
Install updates from vendor's website.
Virtual RAID on CPU (VROC) - update to 8.6.0.1191
Precision 5860 Tower - update to 8.6.0.2003
Precision 7960 Rack - update to 8.6.0.2003
Precision 7960 Tower - update to 8.6.0.2003
Precision 5860 Tower - update to 8.6.0.2003
Precision 7960 Rack - update to 8.6.0.2003
Precision 7960 Tower - update to 8.6.0.2003