EUVD-2026-78772
GHSA-4x2v-m9jj-4p23
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Remote and low-complexity but gated on high-privilege access (PR:H); code execution stays within the same NOS authority so S:U rather than the vendor's S:C, with full C/I/A impact.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
3DescriptionCVE.org
Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download of Code Without Integrity Check vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.
AnalysisAI
Code execution is possible on Dell SmartFabric OS10 switches running versions prior to 10.6.1.3 because the platform downloads code and software images without validating their integrity (CWE-494), so a high-privileged administrator - or an attacker who has already hijacked such an account - can make the device fetch and execute attacker-supplied code. The vendor rates this 9.1 using CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, but the flaw is explicitly not pre-authentication: remote network reachability to the management plane plus existing administrative credentials are mandatory, which is why CISA's SSVC assessment records Exploitation: none, Automatable: no, and Technical Impact: total, and no public exploit was identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already possess high-privilege (administrative) access to the Dell SmartFabric OS10 device (PR:H) and remote/network reachability to its management interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a high-CVSS (9.1) issue whose real-world urgency is materially tempered by its prerequisites and current exploitation signals. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Dell SmartFabric OS10 10.6.1.3 or later, which contains the vendor fix for this integrity-check weakness; plan the upgrade via Dell's supported OS10 upgrade path and verify image signatures during the install per the release notes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Dell SmartFabric OS10 switches and identify any running versions prior to 10.6.1.3, then restrict management plane access to trusted administrative networks and audit high-privileged accounts for unauthorized changes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Smartfabric Os10 Software
View allSession fixation in Dell SmartFabric OS10 Software versions prior to 10.6.1.3 allows remote, unauthenticated attackers t
Command injection in Dell SmartFabric OS10 Software (versions prior to 10.5.6.14) allows a remotely-authenticated, high-
Same weakness CWE-494 – Download of Code Without Integrity Check
View allShare
External POC / Exploit Code
Leaving vuln.today