Dell Peripheral Manager Uncontrolled Search Path Element Vulnerabilities (CVE-2024-22447/2024-22451)

Vulnerability Overview Vulnerability Name: DSA-2024-055: Security Update for Dell Peripheral Manager Uncontrolled Search Path Element Vulnerabilities Vulnerability Description: Dell Peripheral Manager contains multiple uncontrolled search path element vulnerabilities that could be exploited by an attacker to execute arbitrary code through preloading of malicious DLLs. CVSS Base Score: 6.7 CVSS Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Impact Scope Affected Product: Dell Peripheral Manager Affected Versions: - Versions 1.5.1 through 1.7.2 - Versions prior to 1.7.3 Remediation Fixed Version: - Version 1.7.3 or later Release Date: March 27, 2024 Link: Support for Dell Peripheral Manager Additional Information Revision History: - 1.0: Initial release on 2024-04-02 - 2.0: Updated hyperlinks to non-specific location links on 2024-08-09 Acknowledgements: CVE-2024-22447, CVE-2024-22451: Thanks to Yue Liu from the TIANGONG team for reporting this issue. Related Links Dell Security Advisories and Notices Dell Vulnerability Response Policy CVSS Scoring Guide Legal Disclaimer This Dell Technologies security advisory should be read and utilized to help avoid potentially hazardous situations that may arise from the described issues. Dell Technologies distributes security advisories to convey critical security information to users of the affected products. Dell Technologies assesses risks based on the diversity of installed systems, which may not reflect the actual risk to local installations and personal environments. All users are advised to determine the applicability of the information and take appropriate action. Information is provided "as is" without warranty of any kind. Dell Technologies expressly disclaims all warranties, including warranties of merchantability, fitness for a particular purpose, and non-infringement. Under no circumstances shall Dell Technologies, its affiliates, or suppliers be liable for any damages arising out of the use or inability to use this information or related actions, including direct, indirect, incidental, consequential, lost profits, or special damages, even if Dell Technologies, its affiliates, or suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the above limitations may not apply in their entirety. Provide Feedback Users can rate the article, including its accuracy, usefulness, and ease of understanding, and provide additional information. Footer Information Includes links to Account, Support, Contact Us, Community, Products, Solutions, Services, Trading, Artificial Intelligence, Products, Solutions, Services, Trading, Our Company, Our Partners, Resources, etc.

Goal Reached Thanks to every supporter — we hit 100%!

Dell Peripheral Manager Uncontrolled Search Path Element Vulnerabilities (CVE-2024-22447/2024-22451)