Read the docs
TI-2017-05620 Aliases CVE-2017-8023GHSA-2mv3-6453-384c

EMC Networker Remote Code Execution Vulnerability

Priority MEDIUM 51CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

EMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution vulnerability in the Networker Client execution service (nsrexecd) when oldauth authentication method is used. An unauthenticated remote attacker could send arbitrary commands via RPC service to be executed on the host system with the privileges of the nsrexecd service, which runs with administrative privileges.

Why it matters now

EPSS 0.05876 93rd percentileScored 2026-11-07
Fix Fixed Networker (Dell EMC): 9.1.15, 9.2.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Dell EMCNetworker8.2.X; 9.0.X; before 9.1.15; before 9.2.19.1.15, 9.2.1Patch availableCNA
  • Networker VendorDell EMC Affected 8.2.X; 9.0.X; before 9.1.15; before 9.2.1 Fixed in 9.1.15, 9.2.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dell:emc_networker:*:*:*:*:*:*:*:*8.2.0.0 to before 8.2.4.11; 9.0.0.0 – 9.0.1.9; 9.1.0.0 to before 9.1.1.5; 9.2.0.0 to before 9.2.1.0VulnerableDell
  • cpe:2.3:a:dell:emc_networker:*:*:*:*:*:*:*:* Versions 8.2.0.0 to before 8.2.4.11; 9.0.0.0 – 9.0.1.9; 9.1.0.0 to before 9.1.1.5; 9.2.0.0 to before 9.2.1.0 Vulnerable ·Dell

Remediation

  • Fix · CNA Networker (Dell EMC) Fixed in 9.1.15, 9.2.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-8023
  2. 2026-10-03 Alias added: GHSA-2mv3-6453-384c

References

Advisory 1

  • TI-2018-01128 Missing authorization in Dell EMC Avamar, Integrated Data Protection Appliance CVSS 3.0CRITICAL 9.8
  • TI-2018-01141 OS command injection in Dell EMC RecoverPoint CVSS 3.0CRITICAL 9.8
  • TI-2018-07852 Dell EMC Avamar and Integrated Data Protection Appliance Remote Code Execution Vulnerability CVSS 3.0CRITICAL 9.8
  • TI-2018-11243 Dell EMC ESRS Policy Manager versions 6.8 and prior contain a remote code execution… CVSS 3.0CRITICAL 9.8
  • TI-2017-08041 OS command injection in Dell EMC Data Protection Advisor CVSS 3.1HIGH 8.8
  • TI-2019-02726 Buffer overflow in Dell EMC iDRAC CVSS 3.1CRITICAL 9.8
See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences