What’s Vulnerable › Vulnerabilities

CVE-2023-23691

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-01-20 · updated 2026-06-17
• Weakness: CWE-444

Description

Dell EMC PV ME5, versions ME5.1.0.0.0 and ME5.1.0.1.0, contains a Client-side desync Vulnerability. An unauthenticated attacker could potentially exploit this vulnerability to force a victim's browser to desynchronize its connection with the website, typically leading to XSS and DoS.

Affected products

• Dell Powervault Me5012 Firmware: before me5.1.1.0.5 — fixed in me5.1.1.0.5
• Dell Powervault Me5024 Firmware: before me5.1.1.0.5 — fixed in me5.1.1.0.5
• Dell Powervault Me5084 Firmware: before me5.1.1.0.5 — fixed in me5.1.1.0.5

How to fix

Upgrade to a fixed version: Dell Powervault Me5012 Firmware me5.1.1.0.5; Dell Powervault Me5024 Firmware me5.1.1.0.5; Dell Powervault Me5084 Firmware me5.1.1.0.5. Check the vendor advisory for mitigations.

References

• https://www.dell.com/support/kbdoc/en-us/000207533/dsa-2023-018-dell-emc-powervault-me5-security-update-for-a-client-desync-attack-vulnerability
• https://www.dell.com/support/kbdoc/en-us/000207533/dsa-2023-018-dell-emc-powervault-me5-security-update-for-a-client-desync-attack-vulnerability

Get alerted when CVE-2023-23691 or the next vulnerability affects your stack