Dell Enterprise SONiC Vulnerability Advisory: Multiple CVEs including SSH Key Prediction

Critical Vulnerability Information Vulnerability Overview Advisory ID: DSA-2025-275 Title: Dell Enterprise SONiC Distribution Vulnerabilities Summary: Provides remediation for multiple security vulnerabilities in Dell Enterprise SONiC Distribution, which could be exploited by malicious users to compromise systems. Affected Products and Versions Affected Product: Dell Enterprise SONiC Distribution Affected Versions: - Versions 4.0.0 to 4.5.0 - Version 4.5.0a Vulnerability Details CVE IDs: CVE-2024-12133, CVE-2024-12243, CVE-2023-59515, CVE-2023-48560, CVE-2023-48671, CVE-2022-27113, CVE-2025-58741 CVSS Score: 7.5 Description: Dell Enterprise SONiC OS version 4.5.0 contains an issue with cryptographic key generation. During SSH server initialization, a remote attacker can predictably generate key pairs, leading to unauthorized access to communications. Solutions and Mitigations Fixed Version: - Upgrade from version 4.5.0 to 4.5.0a Temporary Workarounds: - For systems installed with 4.5.0 that have not been upgraded to 4.5.0a, users must regenerate new SSH key pairs via the CLI command line. - Systems can also be upgraded to 4.5.0a to fully resolve the issue. Related Links CVE-2024-12133 CVE-2024-12243 CVE-2023-59515 CVE-2023-48560 CVE-2023-48671 CVE-2022-27113 CVE-2025-58741 Update History Version 1.0: Initial release Version 2.0: Updated to include CVE-2025-58741

Goal Reached Thanks to every supporter — we hit 100%!

Dell Enterprise SONiC Vulnerability Advisory: Multiple CVEs including SSH Key Prediction