CVE-2024-37143

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-37143
Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x train) and prior to RCM 3.7.6.0 (for RCM 3.7.x train), Dell PowerFlex custom node using PowerFlex Manager versions prior to 4.6.1.0, Dell InsightIQ versions prior to 5.1.1, and Dell Data Lakehouse versions prior to 1.2.0.0 contain an Improper Link Resolution Before File Access vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability to execute arbitrary code on the system.

10.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://www.dell.com/support/kbdoc/en-us/000258342/dsa-2024-405-security-update-for-dell-products-for-multiple-vulnerabilities Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:dell:data_lakehouse:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:insightiq:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:powerflex_appliance_intelligent_catalog:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:powerflex_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:powerflex_rack_release_certification_matrix:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:powerflex_rack_release_certification_matrix:*:*:*:*:*:*:*:*
History

22 Jan 2026, 16:24

Type Values Removed Values Added
Summary
  • (es) Las versiones del dispositivo Dell PowerFlex anteriores a IC 46.381.00 e IC 46.376.00, las versiones de bastidor de Dell PowerFlex anteriores a RCM 3.8.1.0 (para el tren RCM 3.8.x) y anteriores a RCM 3.7.6.0 (para el tren RCM 3.7.x), el nodo personalizado de Dell PowerFlex que utiliza versiones de PowerFlex Manager anteriores a 4.6.1.0, las versiones de Dell InsightIQ anteriores a 5.1.1 y las versiones de Dell Data Lakehouse anteriores a 1.2.0.0 contienen una vulnerabilidad de resolución de vínculo incorrecta antes del acceso a archivos. Un atacante no autenticado con acceso remoto podría aprovechar esta vulnerabilidad para ejecutar código arbitrario en el sistema.
References () https://www.dell.com/support/kbdoc/en-us/000258342/dsa-2024-405-security-update-for-dell-products-for-multiple-vulnerabilities - () https://www.dell.com/support/kbdoc/en-us/000258342/dsa-2024-405-security-update-for-dell-products-for-multiple-vulnerabilities - Vendor Advisory
CPE cpe:2.3:a:dell:powerflex_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:powerflex_rack_release_certification_matrix:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:data_lakehouse:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:insightiq:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:powerflex_appliance_intelligent_catalog:*:*:*:*:*:*:*:*
First Time Dell insightiq
Dell powerflex Appliance Intelligent Catalog
Dell powerflex Rack Release Certification Matrix
Dell powerflex Manager
Dell data Lakehouse
Dell

10 Dec 2024, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-10 03:15

Updated : 2026-01-22 16:24

NVD link : CVE-2024-37143

Mitre link : CVE-2024-37143

CVE.ORG link : CVE-2024-37143

JSON object : View

Products Affected

dell

  • powerflex_rack_release_certification_matrix
  • data_lakehouse
  • insightiq
  • powerflex_appliance_intelligent_catalog
  • powerflex_manager
CWE
CWE-59

Improper Link Resolution Before File Access ('Link Following')