CVE-2024-45764

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-08 · updated 2026-06-17
Weakness: CWE-304

Description

Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. This is a critical severity vulnerability so Dell recommends customers to upgrade at the earliest opportunity.

Affected products

Dell Enterprise SONiC OS: from 4.1.0 before 4.1.6; from 4.2.0 before 4.2.2 — fixed in 4.1.6, 4.2.2

How to fix

Upgrade to a fixed version: Dell Enterprise SONiC OS 4.1.6, 4.2.2. Check the vendor advisory for mitigations.

References

https://www.dell.com/support/kbdoc/en-us/000245655/dsa-2024-449-security-update-for-dell-enterprise-sonic-distribution-vulnerabilities

Get alerted when CVE-2024-45764 or the next vulnerability affects your stack