CVE-2023-44302
Published: 04 December 2023
Summary
CVE-2023-44302 is a high-severity Improper Authentication (CWE-287) vulnerability in Dell Powerprotect Data Manager Dm5500 Firmware. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Dell DM5500 appliances running version 5.14.0.0 and earlier contain an improper authentication vulnerability tracked as CVE-2023-44302 and CWE-287. The flaw resides in the appliance's authentication mechanism and carries a CVSS 3.1 score of 8.1 with a network attack vector, high complexity, and no required privileges or user interaction.
A remote unauthenticated attacker can exploit the weakness to obtain unauthorized access to protected resources or functionality, with the potential to execute arbitrary code on the affected system. The high impact on confidentiality, integrity, and availability stems directly from bypassing intended authentication controls.
Dell addresses the issue in security advisory DSA-2023-425, which provides a firmware or software update for the PowerProtect Data Manager DM5500 appliance; administrators should apply the patch referenced in the vendor knowledge-base article to eliminate the exposure. The associated EPSS score remains low at 0.0508 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-48658
Vulnerability details
Dell DM5500 5.14.0.0 and prior contain an improper authentication vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to gain access of resources or functionality that could possibly lead to execute arbitrary code.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Detects unauthorized successful logons resulting from improper authentication implementations.
Documented procedures ensure personnel are trained on authentication mechanisms, tangibly lowering the risk of improper authentication being exploited.
Security awareness training instructs users on secure authentication practices and avoiding credential compromise.
Training on authentication mechanisms and best practices decreases the occurrence of improper authentication.
Non-repudiation requires strong authentication mechanisms to irrefutably attribute performed actions to specific individuals or processes.
Session content review can reveal authentication bypasses or failures in session establishment.
Review of authentication-related audit records can detect improper authentication mechanisms or bypasses.
Assessments check authentication mechanisms for correct implementation and effectiveness, reducing successful authentication bypass attempts.