CVE-2024-37144 json
Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x…
published 2024-12-10 22 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-36979
- cvss
- 8.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 6%
- public exploits
- 0
- none known
Summary
Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x train) and prior to RCM 3.7.6.0 (for RCM 3.7.x train), Dell PowerFlex custom node using PowerFlex Manager versions prior to 4.6.1.0, Dell InsightIQ versions prior to 5.1.1, and Dell Data Lakehouse versions prior to 1.2.0.0 contain an Insecure Storage of Sensitive Information vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure. The attacker may be able to use information disclosed to gain unauthorized access to pods within the cluster.
Patch / fix
- Dell Dell PowerFlex appliance 46.376.00, 46.381.00
- Dell Dell PowerFlex rack 3.7.6.0, 3.8.1.0
- Dell Dell PowerFlex custom node 4.6.1.0
- Dell Dell InsightIQ 5.1.1
- Dell Dell Data Lakehouse 1.2.0.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 22 mo ago
Exploit prediction
0.17% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Dell Dell PowerFlex appliance
- Dell Dell PowerFlex rack
- Dell Dell PowerFlex custom node
- Dell Dell InsightIQ
- Dell Dell Data Lakehouse
Classification
- Weakness
-
- CWE-922 Insecure Storage of Sensitive Information
References
Sources
- CVE List CVE-2024-37144
- NVD CVE-2024-37144
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.