CVE-2019-3753: dell emc powerconnect m8024-k
Vulnerability summary
CVE-2019-3753 is a high (CVSS 7.2) vulnerability in dell emc powerconnect m8024-k. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.1% of scored vulnerabilities.
Timeline
- 20-08-2019PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Dell EMC PowerConnect 8024, 7000, M6348, M6220, M8024 and M8024-K running firmware versions prior to 5.1.15.2 contain a plain-text password storage vulnerability. TACACS\Radius credentials are stored in plain text in the system settings menu. An authenticated malicious user with access to the system settings menu may obtain the exposed password to use it in further attacks.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST7.2HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.65%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
0.00 pp
From 0.65% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-312Cleartext Storage of Sensitive InformationThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Affected systems
Dell6 products
- emc_powerconnect_7000_firmware< 5.1.15.2
- emc_powerconnect_8024_firmware< 5.1.15.2
- emc_powerconnect_m6220_firmware< 5.1.15.2
- emc_powerconnect_m6348_firmware< 5.1.15.2
- emc_powerconnect_m8024_firmware< 5.1.15.2
Dell emc6 products
- powerconnect m8024-k≥ unspecified, < 5.1.15.2
- powerconnect 7000≥ unspecified, < 5.1.15.2
- powerconnect 8024≥ unspecified, < 5.1.15.2
- powerconnect m6220≥ unspecified, < 5.1.15.2
- powerconnect m6348≥ unspecified, < 5.1.15.2
2 vendors · 12 products