CVE-2023-28078
Dell Smartfabric Os10 10.5.2.0 – 10.5.2.12
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-28078 is a critical-severity Improper Restriction of Communication Channel to Intended Endpoints (CWE-923) vulnerability in Dell Smartfabric Os10. Its CVSS base score is 9.1 (Critical).
Operationally, ranked in the top 41% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-3 (Device Identification and Authentication) and SC-23 (Session Authenticity) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-31803
Vulnerability Data
Dell OS10 Networking Switches running 10.5.2.x and above contain a vulnerability with zeroMQ when VLT is configured. A remote unauthenticated attacker could potentially exploit this vulnerability leading to information disclosure and a possible Denial of Service when a huge number…
more
of requests are sent to the switch. This is a high severity vulnerability as it allows an attacker to view sensitive data. Dell recommends customers to upgrade at the earliest opportunity.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires unique identification and authentication of devices before establishing a communications session.
Enforces authenticity of communication sessions so the system only exchanges data with verified intended endpoints.
Protects transmitted information with cryptographic integrity mechanisms that implicitly verify endpoint identity.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Network security controls directly enforce endpoint validation and channel restrictions.
A.8.21 mandates identifying/implementing network service security features (authentication, encryption, connection controls, authorization, monitoring, allowed endpoints via rules) and ensuring providers do so, which stops most improper-restriction cases from being exploitable; the bounded remainder is product-level endpoint validation logic (e.g. cert pinning, strict hostname checks) that lives in code rather than in service configuration or provider agreement.
Cryptography can protect channels but does not guarantee correct endpoint identity without additional controls.
Application security requirements may specify endpoint validation but do not implement it.
A.8.27 mandates security-by-design principles (defense-in-depth, least privilege, assume-breach, never-trust/always-verify, end-to-end encryption, dynamic access control) plus design reviews that can stop many channel-misrouting flaws at source, but leaves a bounded remainder (e.g. flawed protocol selection or implementation bugs in the chosen channel that still reach the wrong endpoint).
Secure coding practices can implement endpoint checks but the control itself is process-oriented.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-923, a class-level weakness. Rules are authored against its narrower children: CWE-419.