CVE-2024-48013: Dell SmartFabric OS10 Privilege Escalation

CVE-2024-48013 Overview

CVE-2024-48013 is a privilege escalation vulnerability affecting Dell SmartFabric OS10, the network operating system that powers Dell PowerSwitch data center switches. The flaw stems from execution with unnecessary privileges [CWE-250], allowing a low-privileged remote attacker to elevate privileges on affected devices. The vulnerability impacts SmartFabric OS10 versions 10.5.4.x, 10.5.5.x, 10.5.6.x, and 10.6.0.x. Dell published security advisories DSA-2025-068, DSA-2025-069, DSA-2025-070, and DSA-2025-079 addressing this issue and related vulnerabilities.

Critical Impact
A low-privileged attacker with network access can gain elevated privileges on Dell PowerSwitch infrastructure, compromising confidentiality, integrity, and availability of core network fabric.

Affected Products

Dell SmartFabric OS10 versions 10.5.4.x
Dell SmartFabric OS10 versions 10.5.5.x and 10.5.6.x
Dell SmartFabric OS10 versions 10.6.0.x

Discovery Timeline

2025-03-17 - CVE-2024-48013 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-48013

Vulnerability Analysis

CVE-2024-48013 is classified under CWE-250 (Execution with Unnecessary Privileges). A component within SmartFabric OS10 executes operations with higher privileges than required by its functional role. When a low-privileged authenticated user interacts with that component over the network, the excess privileges become reachable and abusable.

Dell SmartFabric OS10 runs the control and management plane for PowerSwitch platforms deployed in data center spine/leaf fabrics. Successful exploitation gives an attacker elevated access to switch configuration, routing state, and administrative interfaces. From this position, an attacker can pivot laterally, exfiltrate traffic through mirroring, or disable network segments.

Root Cause

The root cause is improper privilege separation within one or more OS10 processes. Rather than dropping privileges after startup or delegating limited authority to user-facing handlers, the affected component retains administrative rights when servicing requests. Low-privileged accounts can therefore trigger code paths that operate above their intended authorization boundary.

Attack Vector

Exploitation requires network access and low-privileged authenticated credentials on the switch. No user interaction is needed. An attacker with valid but limited credentials, such as a read-only network operator account, can invoke the vulnerable functionality and escalate to administrative privileges on the switch. Dell has not published exploitation details, and no public proof-of-concept code has been observed.

Refer to the Dell Security Update DSA-2025-068 and related advisories for vendor guidance.

Detection Methods for CVE-2024-48013

Indicators of Compromise

Authentication events for low-privileged OS10 accounts followed by administrative configuration changes in a short time window.
Unexpected changes to switch running-config, user accounts, ACLs, or SNMP community strings originating from non-admin sessions.
New or modified SSH keys, RADIUS/TACACS+ configuration entries, or role bindings on OS10 devices.

Detection Strategies

Ingest OS10 syslog and AAA audit logs into a centralized SIEM and correlate role changes with the initiating user identity.
Baseline normal CLI and REST API usage per account role, then alert on privileged operations performed by accounts not authorized for them.
Monitor for repeated failed authorization attempts followed by successful privileged actions from the same session.

Monitoring Recommendations

Enable logging for all AAA events, configuration commits, and show running-config retrievals on OS10 switches.
Forward telemetry to a centralized logging platform and retain at least 90 days of switch audit history.
Alert on privileged command execution outside change windows and by accounts that should be limited to read-only operations.

How to Mitigate CVE-2024-48013

Immediate Actions Required

Upgrade Dell SmartFabric OS10 to a fixed release as specified in the applicable Dell Security Advisory for your version branch.
Inventory all PowerSwitch devices running 10.5.4.x, 10.5.5.x, 10.5.6.x, or 10.6.0.x and prioritize patching for internet-adjacent and management-plane-exposed switches.
Rotate credentials for all OS10 local accounts and any shared AAA credentials after patching.

Patch Information

Dell has released fixed versions of SmartFabric OS10 addressing CVE-2024-48013. Consult the vendor advisories for the specific fixed builds applicable to each affected branch: DSA-2025-068, DSA-2025-069, DSA-2025-070, and DSA-2025-079.

Workarounds

Restrict management plane access to OS10 devices using out-of-band management networks and ACLs that only permit trusted jump hosts.
Enforce least-privilege role assignments in AAA and remove unused or unnecessary low-privileged local accounts.
Require multi-factor authentication for all administrative access to switch management interfaces where supported by the AAA backend.

bash

# Configuration example - restrict management access to trusted subnets
# Apply on Dell SmartFabric OS10 (illustrative)
configure terminal
ip access-list MGMT-ACL
  seq 10 permit ip 10.10.0.0/24 any
  seq 20 deny ip any any log
exit
interface mgmt 1/1/1
  ip access-group MGMT-ACL in
exit