Dell Enterprise SONiC OS (information disclosure): An authenticated user can extract sensitive information

Impact

An authenticated user can extract sensitive information from Enterprise SONiC 3.3.0 and earlier. On a switch, 'sensitive information' generally means credentials for the things the switch talks to — TACACS/RADIUS secrets, SNMP communities, image-server logins — so the impact propagates outward from the device.

Who can reach it

Authenticated user with system access on the switch.

What to do

NOS image upgrade plus reboot, then rotate every shared secret configured on the switch. The rotation is the expensive part on a fleet that shares TACACS keys across all devices.

References

Related entries

• Linux kernel (drivers/infiniband/sw/siw): A tenant gets an out-of-bounds kernel array read using values it controls.CVE-2022-50736 · Linux kernel (drivers/infiniband/sw/siw)High
• AMD Secure Processor - hardware config integrity across power save/restore: Hardware configuration state is notCVE-2023-31316 · AMD Secure Processor - hardware config integrity across power save/restoreHigh
• AMI MegaRAC SPx (BMC TLS certificate / cryptographic keys): A hard-coded certificate and its private key ship insideCVE-2023-34338 · AMI MegaRAC SPx (BMC TLS certificate / cryptographic keys)High
• Intel TDX module: Insufficient control-flow management in the TDX module lets a privileged host user deny serviceCVE-2024-21801 · Intel TDX moduleHigh
• SEV-ES / SEV-SNP guest kernel - injection of virtual interrupts 0 and 14: An untrusted hypervisor can inject virtualCVE-2024-25743 · SEV-ES / SEV-SNP guest kernel - injection of virtual interrupts 0 and 14High
• Arista EOS and CVX: malformed CVX cluster messages crash the Sysdb agent and soft-reset the switchCVE-2025-5089 · Arista EOS / CloudVision eXchange (CVX) - Sysdb agent message handlingHigh