Cyber Resilience

CVE-2024-0157

Auth Bypass in Dell Storage Monitoring And Reporting ≤ 5.0.0.0

Published
12 April 2024
Modified
04 February 2025
Patch / advisory
CVSS Score v3.1 5.9
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0040 33th percentile
Risk Priority 46 floored blend · peak EPSS

Summary

CVE-2024-0157 is a medium-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Dell Storage Monitoring And Reporting. Its CVSS base score is 5.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique OS Exhaustion Flood (T1499.001); ranked at the 33th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-23 (Session Authenticity) and SC-5 (Denial-of-service Protection) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Dell Storage Resource Manager, 4.9.0.0 and below, contain(s) a Session Fixation Vulnerability in SRM Windows Host Agent. An adjacent network unauthenticated attacker could potentially exploit this vulnerability, leading to the hijack of a targeted user's application session.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1499.001 OS Exhaustion Flood Impact
Adversaries may launch a denial of service (DoS) attack targeting an endpoint's operating system (OS).
T1498 Network Denial of Service Impact
Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users.
T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
T1499.002 Service Exhaustion Flood Impact
Adversaries may target the different network services provided by systems to conduct a denial of service (DoS).
T1499.003 Application Exhaustion Flood Impact
Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-30476Same vendor: Dell
CVE-2023-39248Same vendor: Dell
CVE-2024-42426Same vendor: Dell
CVE-2023-23689Same vendor: Dell
CVE-2025-26481Same vendor: Dell
CVE-2024-47239Same vendor: Dell
CVE-2023-24574Same vendor: Dell
CVE-2024-37125Same vendor: Dell
CVE-2025-46605Same vendor: Dell
CVE-2025-26480Same vendor: Dell

Affected Assets

dell
storage monitoring and reporting
≤ 5.0.0.0
dell
storage resource manager
≤ 5.0.0.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V4.4.4
  • V7.6.2

Mitigating Controls (NIST 800-53 r5) AI

Requires protection of session authenticity, which directly stops an attacker from using a stolen or fixed session identifier after authentication.

SC-5 directly limits the effects of resource-exhaustion events that constitute uncontrolled consumption.

SC-6 enforces explicit allocation limits on resources, structurally preventing the weakness from occurring.

Limits the lifetime of any session (fixed or not), thereby reducing the window during which a stolen identifier remains usable.

Enforces that only properly authorized (i.e., freshly authenticated) sessions can access resources, making a pre-existing fixed session ID unusable.

Forces re-authentication under defined conditions, which should result in issuance of a fresh session identifier and invalidation of any prior one.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 mostly match
prevents

Proper authentication processes must invalidate prior session identifiers to prevent fixation attacks.

PR.IR-04 mostly match
prevents

Explicitly requires monitoring and maintaining resource capacity, directly addressing uncontrolled consumption to preserve availability.

DE.CM-09 partial match
prevents

Continuous monitoring of computing resources can detect resource exhaustion but does not itself enforce allocation limits.

PR.AA-01 partial match
prevents

Managing identities and credentials includes handling session identifiers as temporary credentials that must be invalidated on re-authentication.

PR.AA-04 partial match
prevents

Protecting and verifying identity assertions encompasses secure handling and regeneration of session tokens.

PR.IR-03 partial match
prevents

Resilience mechanisms such as avoiding single points of failure indirectly reduce impact of resource exhaustion.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Resource-utilization monitoring and alerting on bottlenecks or overloads limits the impact of denial-of-service or resource-exhaustion attacks.

finds

Security testing can detect session-fixation issues, yet the weakness absence does not replace comprehensive testing.

prevents

By continuously monitoring utilization, stress-testing peak loads, and maintaining documented plans to scale or throttle resources, the control directly limits an attacker’s ability to drive a system into uncontrolled resource exhaustion.

degrades

Access-control policy can mandate session invalidation on re-authentication, but does not prescribe the technical mechanism.

degrades

Identity-management procedures can require new session tokens after login, yet the control is broader than session handling.

degrades

Authentication-information rules can include session-token lifecycle requirements, but the control focuses on credential management.

References