CVE-2024-29170 Overview
CVE-2024-29170 is a hard-coded credentials vulnerability affecting Dell PowerScale OneFS versions 8.2.x through 9.8.0.x. The flaw allows an unauthenticated attacker on an adjacent network to exploit embedded credentials shipped with the product. Successful exploitation can lead to information disclosure of network traffic and denial of service against the storage cluster.
Dell disclosed the issue in security advisory DSA-2024-210 and released fixed firmware for affected OneFS releases. The vulnerability is tracked under [CWE-798] (Use of Hard-Coded Credentials) and carries a CVSS 3.1 score of 8.1.
Critical Impact
An adjacent-network attacker without credentials can leverage embedded secrets to intercept OneFS network traffic and disrupt cluster availability.
Affected Products
- Dell PowerScale OneFS 8.2.x
- Dell PowerScale OneFS 9.0.x through 9.7.x
- Dell PowerScale OneFS 9.8.0.x
Discovery Timeline
- 2024-06-04 - CVE-2024-29170 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-29170
Vulnerability Analysis
Dell PowerScale OneFS is the distributed file system powering Isilon and PowerScale scale-out NAS clusters. The affected releases ship with hard-coded credentials embedded in the product. An attacker positioned on an adjacent network segment can use these known credentials to interact with cluster services without authenticating as a legitimate user.
Because the credentials are static across deployments, no per-cluster secret rotation or customer configuration mitigates the exposure. The attack surface is limited to adjacent networks such as the cluster back-end, management VLAN, or directly attached storage network, which restricts remote internet exploitation.
The exploitation results in confidentiality and availability impact. An attacker can observe traffic traversing internal cluster interfaces and disrupt services relying on the affected component, degrading storage availability for downstream applications.
Root Cause
The root cause is the inclusion of static credentials in the OneFS distribution [CWE-798]. Because the secrets are compiled or provisioned identically across installations, any party with knowledge of the credentials and adjacent network reachability can authenticate to the affected service.
Attack Vector
Exploitation requires adjacent-network access (AV:A) to a PowerScale cluster interface exposing the affected service. No user interaction and no prior authentication are required. Typical attacker positioning includes access to a management VLAN, back-end interconnect, or a compromised host on the same layer-2 segment as the cluster. The vulnerability does not require crafted payloads; possession of the embedded credential is sufficient to authenticate, decrypt, or replay traffic and to invoke service functions that lead to denial of service.
No public proof-of-concept or exploit code is currently listed, and the vulnerability is not present on the CISA KEV list.
Detection Methods for CVE-2024-29170
Indicators of Compromise
- Authentication events on OneFS management or back-end interfaces from hosts outside the documented cluster inventory.
- Unexpected sessions or connections on internal cluster VLANs from workstations, jump hosts, or lab systems.
- Sudden degradation or restarts of OneFS services accompanied by adjacent-network traffic to management ports.
Detection Strategies
- Inventory all PowerScale nodes and confirm the running OneFS version against Dell advisory DSA-2024-210 to identify vulnerable clusters.
- Enable and centralize OneFS audit logging, including isi_audit_d protocol and configuration events, to spot anomalous administrative activity.
- Deploy network monitoring on management and back-end VLANs to alert on new source addresses initiating sessions to cluster nodes.
Monitoring Recommendations
- Forward OneFS syslog and audit events to a SIEM or data lake for correlation with network telemetry.
- Baseline expected administrative source hosts and alert on deviations targeting PowerScale cluster IPs.
- Monitor for repeated failed or successful logins from unexpected subnets adjacent to the cluster back-end network.
How to Mitigate CVE-2024-29170
Immediate Actions Required
- Apply the fixed OneFS release listed in Dell advisory DSA-2024-210 to all cluster nodes.
- Restrict layer-2 and layer-3 reachability to PowerScale management and back-end interfaces to a documented administrator subnet.
- Audit recent authentication and configuration changes on affected clusters for signs of misuse.
Patch Information
Dell released patched OneFS builds addressing CVE-2024-29170 as part of Dell Security Update DSA-2024-210. Upgrade paths depend on the current OneFS train; consult the advisory for the minimum fixed version corresponding to each supported release line.
Workarounds
- Isolate PowerScale back-end and management networks from general-purpose VLANs using dedicated switches or strict ACLs.
- Enforce port security and 802.1X on switch ports adjacent to cluster interfaces to limit unauthorized hosts.
- Where patching must be deferred, coordinate with Dell support for any interim configuration guidance tied to DSA-2024-210.
# Example: verify running OneFS version on a node before and after patching
isi version
isi upgrade cluster view
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
