{"id":"CVE-2018-15784","published":"2019-01-18T22:00:00Z","modified":"2024-09-16T22:51:06Z","title":"DSA-2019-001: Dell Networking OS10 Improper Certificate Validation Vulnerability","vendor":"Dell","product":"Dell Networking OS10","tier":"core","eol":null,"affectedVersions":[{"vendor":"Dell","product":"Dell Networking OS10","versions":[">= unspecified, < 10.4.3.0"]}],"description":{"text":"Dell Networking OS10 versions prior to 10.4.3.0 contain a vulnerability in the Phone Home feature which does not properly validate the server's certificate authority during TLS handshake. Use of an invalid or malicious certificate could potentially allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":7.4,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0061,"percentile":0.49062,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.dell.com/support/article/us/en/04/sln315899/dsa-2019-001-dell-networking-os10-improper-certificate-validation-vulnerability?lang=en","tags":["x_refsource_MISC"]}],"techniques":[{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["collection","credential-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"primary_impact","evidence":[],"confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-7647","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-7647","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1557"],"provenance":"source"}],"timeline":[{"date":"2019-01-18","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2018-15784","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":15.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":9.81,"detail":"percentile 0.4906"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.18,"detail":"base score 7.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}