CVE-2024-45763: Dell Enterprise SONiC OS RCE Vulnerability

CVE-2024-45763 Overview

CVE-2024-45763 is an OS Command Injection vulnerability affecting Dell Enterprise SONiC OS versions 4.1.x and 4.2.x. The flaw stems from improper neutralization of special elements used in an OS command [CWE-78]. A remote attacker with high privileges can inject arbitrary operating system commands into the underlying shell. Successful exploitation leads to arbitrary command execution on the affected network operating system. Dell classifies this issue as critical severity and recommends customers upgrade immediately to a fixed release.

Critical Impact
Authenticated remote attackers can execute arbitrary OS commands on Dell Enterprise SONiC switches, compromising the confidentiality, integrity, and availability of core network infrastructure.

Affected Products

Dell Enterprise SONiC Distribution 4.1.x
Dell Enterprise SONiC Distribution 4.2.x
Network switches running vulnerable SONiC OS builds

Discovery Timeline

2024-11-08 - CVE-2024-45763 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45763

Vulnerability Analysis

Dell Enterprise SONiC OS exposes management interfaces that accept user-supplied input and pass it to underlying operating system commands. The vulnerable code path fails to neutralize shell metacharacters before command execution. An authenticated attacker with high privileges can append shell operators such as ;, |, &&, or backticks to legitimate parameters. The resulting string is executed by the OS shell with the privileges of the management process. Because SONiC runs on the switch control plane, command execution translates directly into control over routing, ACLs, and traffic forwarding.

Root Cause

The root cause is [CWE-78] Improper Neutralization of Special Elements used in an OS Command. Input passed to management functions reaches a shell interpreter without adequate validation, allowlisting, or use of parameterized execution APIs. The code relies on direct string concatenation into shell command lines rather than safe subprocess invocation.

Attack Vector

The attack vector is network-based and requires authentication with high privileges on the SONiC management plane. No user interaction is required. An attacker who has obtained administrator credentials — through credential theft, reuse, or supply-chain compromise — can send crafted requests to a vulnerable management endpoint. The injected payload executes as part of the resulting shell command, granting the attacker full command execution on the switch.

No verified public exploit code or proof-of-concept is available for this issue. Refer to the Dell Security Update DSA-2024-449 for vendor-supplied technical details.

Detection Methods for CVE-2024-45763

Indicators of Compromise

Unexpected shell processes (bash, sh, python) spawned as children of SONiC management daemons.
Configuration or CLI audit log entries containing shell metacharacters such as ;, |, &&, $(, or backticks in parameter fields.
Outbound network connections from switch management interfaces to unfamiliar hosts.
New or modified files in /tmp, /var/tmp, or user home directories on the switch following administrative sessions.

Detection Strategies

Enable command auditing on SONiC and forward audit logs to a central SIEM for pattern matching on shell metacharacters within API and CLI parameters.
Baseline the expected process tree of SONiC management services and alert on deviations, especially interactive shells or scripting interpreters.
Correlate administrator login events with subsequent process execution to identify anomalous command chains after authentication.

Monitoring Recommendations

Monitor syslog, REST API access logs, and gNMI/CLI transaction logs for high-privileged sessions issuing unusual parameters.
Alert on outbound connections initiated from switch management VRFs to non-approved destinations.
Track configuration changes and firmware version drift across the SONiC fleet to identify unauthorized modifications.

How to Mitigate CVE-2024-45763

Immediate Actions Required

Upgrade Dell Enterprise SONiC OS to a fixed release identified in Dell Security Update DSA-2024-449.
Restrict management-plane access to a dedicated out-of-band network and trusted jump hosts only.
Rotate administrator credentials and enforce multi-factor authentication for all privileged accounts on SONiC devices.
Review recent configuration changes and audit logs for signs of prior exploitation.

Patch Information

Dell has released fixed versions of Enterprise SONiC Distribution addressing CVE-2024-45763. Consult the Dell Security Update DSA-2024-449 advisory for the specific patched versions and upgrade procedure for 4.1.x and 4.2.x branches.

Workarounds

Limit administrative accounts to the minimum set required and remove unused high-privilege users.
Place management interfaces behind ACLs that only permit connections from bastion hosts and network operations tooling.
Disable or block any management protocol not required for operations to reduce the attack surface until patches are applied.
Implement session recording on jump hosts used to reach SONiC devices to preserve forensic evidence of privileged activity.

bash

# Configuration example: restrict SONiC management access with ACL
sonic-cli
configure terminal
ip access-list MGMT-ACL
  seq 10 permit tcp 10.10.0.0/24 any eq 22
  seq 20 permit tcp 10.10.0.0/24 any eq 443
  seq 30 deny ip any any
interface Management0
  ip access-group MGMT-ACL in
end
write memory