VulnerabilityModified

CVE-2023-4129

Dell Data Protection Central, version 19.9, contains an Inadequate Encryption Strength Vulnerability.

HIGH 7.5EPSS 0.17%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Dell Data Protection Central, version 19.9, contains an Inadequate Encryption Strength Vulnerability. An unauthenticated network attacker could potentially exploit this vulnerability, allowing an attacker to recover plaintext from a block of ciphertext.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.17% probability · 7th percentile
CISA KEV: Not listed
Weakness: CWE-326
Affected: dell/data protection central
Source: security_alert@emc.com

References

https://www.dell.com/support/kbdoc/en-us/000218045/dsa-2023-346-security-update-for-dell-data-protection-centralVendor Advisory
https://www.dell.com/support/kbdoc/en-us/000218045/dsa-2023-346-security-update-for-dell-data-protection-centralVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.