Vulnerability Details : CVE-2022-34404

Dell System Update, version 2.0.0 and earlier, contains an Improper Certificate Validation in data parser module. A local attacker with high privileges could potentially exploit this vulnerability, leading to credential theft and/or denial of service.

Vulnerability category: Denial of service

Published 2023-02-11 01:23:24

Updated 2023-02-21 17:24:53

Source Dell

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-34404

Probability of exploitation activity in the next 30 days: 0.04%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 6 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2022-34404

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
6.0	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H	0.8	5.2	nvd@nist.gov
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: High
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	3.9	2.5	security_alert@emc.com
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2022-34404

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.
Assigned by:
- nvd@nist.gov (Primary)
- security_alert@emc.com (Secondary)

References for CVE-2022-34404

https://www.dell.com/support/kbdoc/000203733

Access Denied
Vendor Advisory

Products affected by CVE-2022-34404

Dell » System Update
Versions before (<) 2.0.1.0
cpe:2.3:a:dell:system_update:*:*:*:*:*:*:*:*
Matching versions