Read the docs
TI-2024-30733 Aliases CVE-2024-45765GHSA-6x85-j5hx-4hj5

OS command injection in Dell Enterprise SONiC OS

Priority MEDIUM 44CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution. This is a critical severity vulnerability as it allows high privilege OS commands to be executed with a less privileged role; so Dell recommends customers to upgrade at the earliest opportunity.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01395 72nd percentileScored 2026-11-07
Fix Fixed Enterprise SONiC OS (Dell): 4.1.6, 4.2.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellEnterprise SONiC OSN/A to before 4.1.6; N/A to before 4.2.24.1.6, 4.2.2Patch availableCNA
  • Enterprise SONiC OS VendorDell Affected N/A to before 4.1.6; N/A to before 4.2.2 Fixed in 4.1.6, 4.2.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:dell:enterprise_sonic_distribution:*:*:*:*:*:*:*:*4.1.0 to before 4.1.6; 4.2.0 to before 4.2.2VulnerableDell
  • cpe:2.3:o:dell:enterprise_sonic_distribution:*:*:*:*:*:*:*:* Versions 4.1.0 to before 4.1.6; 4.2.0 to before 4.2.2 Vulnerable ·Dell

Remediation

  • Fix · CNA Enterprise SONiC OS (Dell) Fixed in 4.1.6, 4.2.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Dell Enterprise SONiC OS — dell.com/support/kbdoc/en-us/000245655/dsa-2024-449-securit…

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2024-30731 OS command injection in Dell Enterprise SONiC OSPriority MEDIUM 44
    • TI-2024-30732 Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in…Priority MEDIUM 43
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-45765
  2. 2026-10-03 Alias added: GHSA-6x85-j5hx-4hj5

References

Advisory 1

  • TI-2023-15766 Improper input validation in Dell Enterprise SONiC OS CVSS 3.1CRITICAL 9.8
  • TI-2024-30731 OS command injection in Dell Enterprise SONiC OS CVSS 3.1CRITICAL 9.1
  • TI-2024-30732 Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in… CVSS 3.1CRITICAL 9.8
  • TI-2023-10192 Uncontrolled resource consumption in Dell Enterprise SONiC OS CVSS 3.1HIGH 7.5
  • TI-2025-17145 Sensitive information in log files in Dell Enterprise SONiC OS CVSS 3.1HIGH 8.0
  • TI-2022-15323 Hard-coded credentials in Dell Enterprise SONiC OS CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences