CVE-2024-49559 Overview
CVE-2024-49559 is a Use of Default Password vulnerability [CWE-1393] in Dell SmartFabric OS10 Software. The affected releases include versions 10.5.4.x, 10.5.5.x, 10.5.6.x, and 10.6.0.x. A low-privileged attacker with remote network access can leverage the default credentials to gain unauthorized access to the switch operating system.
Dell published multiple advisories addressing OS10 vulnerabilities, including DSA-2025-068, DSA-2025-069, DSA-2025-070, and DSA-2025-079. Because SmartFabric OS10 runs on data-center networking hardware, successful exploitation can pivot attackers into privileged network infrastructure.
Critical Impact
Remote unauthorized access to Dell SmartFabric OS10 switches through default credentials, exposing traffic paths, VLAN segmentation, and fabric control planes to a low-privileged network-based attacker.
Affected Products
- Dell SmartFabric OS10 10.5.4.x
- Dell SmartFabric OS10 10.5.5.x and 10.5.6.x
- Dell SmartFabric OS10 10.6.0.x
Discovery Timeline
- 2025-03-17 - CVE-2024-49559 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-49559
Vulnerability Analysis
CVE-2024-49559 stems from Dell SmartFabric OS10 shipping with a preconfigured default password [CWE-1393]. The credential is either identical across deployments or predictable, allowing attackers to authenticate as a low-privileged principal without any prior compromise. Once authenticated, the attacker gains a foothold on the switch management plane.
Dell classifies the flaw as network-exploitable with low attack complexity and no user interaction. The confidentiality, integrity, and availability impact is high because SmartFabric OS10 controls Layer 2 and Layer 3 forwarding across data-center fabrics. Attackers who reach the management interface can inspect configuration, alter routing, or disrupt the fabric.
Root Cause
The root cause is the presence of vendor-supplied default credentials that remain active on affected OS10 releases. Deployments that never rotated the built-in account leave the switch open to authentication using well-known values. This is a configuration-and-design flaw rather than a memory-safety issue.
Attack Vector
Exploitation requires network reachability to the OS10 management interface, typically SSH or the REST API. An attacker submits the default credential set, receives an authenticated session, and executes commands available to that account. From there, further privilege abuse or lateral movement into the fabric is possible.
No public proof-of-concept, ExploitDB entry, or CISA KEV listing has been recorded for CVE-2024-49559 at time of writing. The EPSS probability remains low, but exposure of switch management interfaces to untrusted networks materially increases real-world risk.
Detection Methods for CVE-2024-49559
Indicators of Compromise
- Successful SSH or REST API logins to SmartFabric OS10 switches from unexpected source IP ranges or outside authorized jump hosts.
- Authentication events using default or factory account names that should have been disabled after provisioning.
- Configuration changes, user additions, or role modifications on OS10 devices without a corresponding change ticket.
Detection Strategies
- Audit OS10 device configurations for the continued presence of default accounts and compare against a hardened baseline.
- Forward OS10 syslog and AAA authentication logs to a central SIEM and alert on logins by default usernames.
- Correlate switch login events with identity provider records to flag sessions that bypass centralized authentication.
Monitoring Recommendations
- Enable command accounting on OS10 and stream events to the Singularity Data Lake or an equivalent SIEM for OCSF-normalized analysis.
- Monitor east-west and north-south flows for anomalous management-plane traffic reaching switches from user VLANs.
- Review privileged session recordings for out-of-hours access to network fabric devices.
How to Mitigate CVE-2024-49559
Immediate Actions Required
- Apply the fixed OS10 release referenced in Dell advisories DSA-2025-068, DSA-2025-069, DSA-2025-070, and DSA-2025-079.
- Rotate all local account passwords on OS10 devices and disable or remove any factory-default accounts.
- Restrict management-plane access to a dedicated out-of-band network and named administrator sources.
Patch Information
Dell has released fixed builds of SmartFabric OS10 addressing CVE-2024-49559. Administrators should consult the DSA-2025-068, DSA-2025-069, DSA-2025-070, and DSA-2025-079 knowledge-base articles on the Dell Support portal for target versions matching their installed branch (10.5.4.x, 10.5.5.x, 10.5.6.x, or 10.6.0.x) and follow Dell's documented upgrade procedure.
Workarounds
- Enforce centralized AAA using TACACS+ or RADIUS and disable local default accounts on OS10 switches.
- Place OS10 management interfaces behind an access control list that permits only known administrative subnets.
- Require multi-factor authentication on the bastion or jump host used to reach network fabric devices.
# Configuration example: rotate credentials and restrict management access on OS10
configure terminal
username admin password <StrongRotatedSecret> role sysadmin
no username linuxadmin
ip access-list MGMT-ACL
permit ip 10.10.0.0/24 any
deny ip any any log
interface mgmt 1/1/1
ip access-group MGMT-ACL in
aaa authentication login default group tacacs+ local
end
write memory
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
