Smartfabric Manager
Monthly
Insufficient verification of data authenticity in Dell SmartFabric Manager versions prior to 2.2.1 allows an authenticated low-privilege user to have attacker-supplied data accepted as trusted, resulting in elevation of privileges with high confidentiality and integrity impact but no availability impact. The flaw is remotely reachable over the management interface with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1 High); the prerequisite is that the attacker already holds valid low-privilege credentials on the fabric manager and can reach its management plane. No public exploit identified at time of analysis, and there is no CISA KEV listing for this CVE; Dell's advisory addresses multiple third-party component vulnerabilities in the same update.
Dell SmartFabric Manager installations running versions earlier than 2.2.1 can disclose limited information to a low-privileged attacker who already holds a valid account and can either reach the management interface over the network or induce a legitimate user to perform an action. The flaw is rated CVSS 3.1 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N), so it requires authentication plus user interaction and results only in low confidentiality impact with no integrity or availability effect - not an unauthenticated, default-configuration remote compromise. There is no evidence of active exploitation (the issue is not in CISA KEV), no public proof-of-concept identified at time of analysis, and no independent EPSS signal was supplied; this is a genuinely low-priority issue by every available signal.
Insufficient verification of data authenticity in Dell SmartFabric Manager versions prior to 2.2.1 allows an authenticated low-privilege user to have attacker-supplied data accepted as trusted, resulting in elevation of privileges with high confidentiality and integrity impact but no availability impact. The flaw is remotely reachable over the management interface with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1 High); the prerequisite is that the attacker already holds valid low-privilege credentials on the fabric manager and can reach its management plane. No public exploit identified at time of analysis, and there is no CISA KEV listing for this CVE; Dell's advisory addresses multiple third-party component vulnerabilities in the same update.
Dell SmartFabric Manager installations running versions earlier than 2.2.1 can disclose limited information to a low-privileged attacker who already holds a valid account and can either reach the management interface over the network or induce a legitimate user to perform an action. The flaw is rated CVSS 3.1 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N), so it requires authentication plus user interaction and results only in low confidentiality impact with no integrity or availability effect - not an unauthenticated, default-configuration remote compromise. There is no evidence of active exploitation (the issue is not in CISA KEV), no public proof-of-concept identified at time of analysis, and no independent EPSS signal was supplied; this is a genuinely low-priority issue by every available signal.