description: Dell EMC PowerConnect 8024, 7000, M6348, M6220, M8024 and M8024-K running firmware versions prior to 5.1.15.2 contain a plain-text password storage vulnerability. TACACS\Radius credentials are stored in plain text in the system settings menu. An authenticated malicious user with access to the system settings menu may obtain the exposed password to use it in further attacks.
problem types: CWE-312 Cleartext Storage of Sensitive Information
affected:
{
product: PowerConnect 8024
vendor: Dell EMC
versions:
lessThan: 5.1.15.2, status: affected, version: unspecified, versionType: custom
}
{
product: PowerConnect 7000
vendor: Dell EMC
versions:
lessThan: 5.1.15.2, status: affected, version: unspecified, versionType: custom
}
{
product: PowerConnect M6348
vendor: Dell EMC
versions:
lessThan: 5.1.15.2, status: affected, version: unspecified, versionType: custom
}
{
product: PowerConnect M6220
vendor: Dell EMC
versions:
lessThan: 5.1.15.2, status: affected, version: unspecified, versionType: custom
}
{
product: PowerConnect M8024
vendor: Dell EMC
versions:
lessThan: 5.1.15.2, status: affected, version: unspecified, versionType: custom
}
{
product: PowerConnect  M8024-K
vendor: Dell EMC
versions:
lessThan: 5.1.15.2, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.0
]