Horizon Alert
Summary of the vulnerability and why it matters
Dell RecoverPoint for Virtual Machines has a critical flaw where it uses hardcoded credentials. This means an attacker who knows these credentials could get unauthorized root access to the system from anywhere on the network. This is a significant risk because it allows for deep system compromise.
- Gaining full system control.
- Attackers can exploit this remotely.
- Affects data protection systems.
Attack Path
How an attacker could exploit the issue
An unauthenticated remote attacker can leverage the hardcoded credentials in Dell RecoverPoint for Virtual Machines to gain unauthorized access to the underlying operating system. This would allow them to achieve root-level persistence and maintain access to sensitive data or systems. The attack requires only network access and knowledge of the embedded credentials.
- Unauthenticated remote access needed.
- Targets RecoverPoint for VMs.
- Root persistence is the goal.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability is a critical issue because it allows unauthenticated, remote attackers to gain root-level persistence on the underlying operating system using a hardcoded credential. The ease of exploitation due to hardcoded credentials makes it highly attractive to attackers, especially given its presence on the KEV catalog.
- Known exploited by UNC6201.
- Added to CISA KEV.
- Critical severity, remote code execution.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize immediate patching of Dell RecoverPoint for Virtual Machines to version 6.0.3.1 HF1 or later to address the critical hardcoded credential vulnerability. If immediate patching is not feasible, isolate affected systems from untrusted networks to prevent exploitation of the hardcoded credentials.
- Apply Dell's remediation script or upgrade.
- Isolate affected systems from the network.
- Monitor for unauthorized access attempts.
