CVE-2024-25949: Dell Networking OS10 Privilege Escalation

CVE-2024-25949 Overview

CVE-2024-25949 is an improper authorization vulnerability affecting Dell Networking OS10 switches. The flaw exists in versions 10.5.6.x, 10.5.5.x, 10.5.4.x, and 10.5.3.x. A remote authenticated attacker can exploit this weakness to escalate privileges on affected switches. The vulnerability maps to [CWE-285: Improper Authorization] and impacts core networking infrastructure used in enterprise and data center environments. Successful exploitation grants attackers elevated access, allowing them to bypass intended authorization controls and gain functionality reserved for higher-privileged accounts. Dell published advisory DSA-2024-087 to address the issue.

Critical Impact
An authenticated attacker with low privileges can escalate to higher privileges on Dell OS10 switches, compromising confidentiality, integrity, and availability of the network device.

Affected Products

Dell Networking OS10 version 10.5.3.x
Dell Networking OS10 version 10.5.4.x
Dell Networking OS10 versions 10.5.5.x and 10.5.6.x

Discovery Timeline

2024-06-12 - CVE-2024-25949 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25949

Vulnerability Analysis

CVE-2024-25949 is an improper authorization flaw ([CWE-285]) in Dell Networking OS10, the operating system that runs on Dell PowerSwitch data center and campus switches. Dell OS10 exposes management functionality through CLI, REST APIs, and network protocols, all of which require role-based authorization checks to enforce privilege separation.

The vulnerability stems from missing or incorrect authorization enforcement on privileged operations. Authenticated users with lower-privilege roles can invoke functionality intended for higher-privileged administrators. Because the switch operating system controls forwarding behavior, ACLs, routing, and management access, privilege escalation on OS10 translates directly to control over network traffic paths.

Root Cause

The root cause is improper authorization logic that fails to validate the caller's role against the required privilege level for a given operation. Dell's advisory (DSA-2024-087) categorizes this as an improper authorization issue rather than a memory safety or injection defect. The check that should reject low-privilege callers is either missing, incorrectly ordered, or evaluates against an attacker-controllable value.

Attack Vector

Exploitation requires network access to the switch management plane and valid low-privilege credentials. No user interaction is needed. Once authenticated, the attacker issues requests that trigger the improperly authorized code path, obtaining elevated privileges. From there, the attacker can modify switch configuration, alter routing, disable logging, or capture traffic. Because OS10 switches often sit at trust boundaries between network segments, escalation on the switch can enable lateral movement across the wider network.

Dell has not published proof-of-concept code, and CVE-2024-25949 is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Dell Security Advisory DSA-2024-087 for technical remediation details.

Detection Methods for CVE-2024-25949

Indicators of Compromise

Unexpected configuration changes on OS10 switches performed by non-administrator accounts.
Authentication events where a low-privilege user account subsequently executes privileged CLI commands or API calls.
New local accounts, SSH keys, or modified AAA configuration on switches without a corresponding change record.
Disabled or altered logging, syslog, or SNMP settings following an authenticated session.

Detection Strategies

Compare running configuration against known-good baselines and alert on drift, particularly changes to aaa, username, line vty, and acl sections.
Correlate switch authentication logs with command-accounting logs to identify privilege level mismatches between the user role and the commands executed.
Enable TACACS+ or RADIUS command accounting to capture per-command authorization decisions and forward the logs to a central analytics platform.

Monitoring Recommendations

Forward OS10 syslog and AAA accounting records to a centralized SIEM or data lake for retention and correlation.
Alert on any use of privileged commands by accounts that are not members of the network administrator role group.
Track REST API calls to the OS10 management interface and flag privilege-changing operations from unexpected source addresses.

How to Mitigate CVE-2024-25949

Immediate Actions Required

Upgrade Dell Networking OS10 to the fixed release identified in Dell advisory DSA-2024-087.
Rotate credentials for all OS10 local and AAA-managed accounts, especially any low-privilege accounts that had network access to switch management interfaces.
Audit switch configurations against a trusted baseline and revert unauthorized changes.
Restrict management-plane access to a dedicated out-of-band management network or jump hosts.

Patch Information

Dell released fixed OS10 firmware as part of DSA-2024-087. Administrators should consult the Dell Security Update for OS10 advisory to identify the minimum fixed version for each affected 10.5.x branch and schedule upgrades through Dell's standard OS10 image installation process.

Workarounds

Limit switch management access to trusted administrator subnets using management ACLs on VTY lines and REST API endpoints.
Reduce the number of authenticated user accounts on OS10 devices to the minimum required, and remove unused local accounts.
Enforce centralized AAA with TACACS+ or RADIUS command authorization so that privileged commands require explicit server-side approval.
Enable and monitor command accounting to detect privilege abuse until patching is complete.

bash

# Example OS10 hardening: restrict management access and enforce AAA command authorization
configure terminal
 ip access-list MGMT-ACL
  permit ip 10.0.10.0/24 any
  deny ip any any log
 !
 line vty
  access-class MGMT-ACL in
 !
 aaa authentication login default group tacacs+ local
 aaa authorization commands 15 default group tacacs+ local
 aaa accounting commands 15 default start-stop group tacacs+
end
write memory