CVE-2022-29089: dell dell networking os10 Insufficiently Protected Credentials

Vulnerability summary

CVE-2022-29089 is a medium (CVSS 6.4) Insufficiently Protected Credentials vulnerability in dell dell networking os10. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 48.1% of scored vulnerabilities.

Timeline

1. 28-09-2022
   PublishedVulnerability first disclosed.
2. 20-05-2025
   Last modifiedVulnerability information updated.

Description

Dell Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an information disclosure vulnerability. A remote, unauthenticated attacker could potentially exploit this vulnerability by reverse engineering to retrieve sensitive information and access the REST API with admin privileges.

• CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.