Dell Enterprise SONiC (privilege boundary in CLI): High-privilege OS commands can be run by users holding less

Impact

High-privilege OS commands can be run by users holding less privileged roles. Whatever role separation you built for your NOC — read-only, operator, admin — does not hold on the switch. Relevant to any operator who gives tenants or contractors scoped switch access.

Who can reach it

Authenticated user with a low-privilege SONiC role.

What to do

NOS image upgrade and reboot per switch. Until then, do not issue low-privilege SONiC accounts to anyone you would not give admin, because the distinction is not enforced.

References

Related entries

• Arista EOS (OpenConfig gNOI authorization): The gNOI equivalent of the gNMI authorization bypass: operationsCVE-2025-1260 · Arista EOS (OpenConfig gNOI authorization)Critical
• Linux kernel - RDMA/rxe (Soft-RoCE) receive path, drivers/infiniband/sw/rxe/rxe_recv.c: Rxe_rcv() checked only that anCVE-2026-46043 · Linux kernel - RDMA/rxe (Soft-RoCE) receive path, drivers/infiniband/sw/rxe/rxe_recv.cCritical
• Linux kernel - SRP (SCSI RDMA Protocol) initiator, drivers/infiniband/ulp/srp/ib_srp.c: The SRP initiator copied theCVE-2026-53186 · Linux kernel - SRP (SCSI RDMA Protocol) initiator, drivers/infiniband/ulp/srp/ib_srp.cCritical
• Dell SmartFabric OS10 before 10.6.1.3: code downloaded without integrity check allows code executionCVE-2026-63696 · Dell SmartFabric OS10 (code download without integrity check)Critical
• Linux kernel - RDMA/rtrs server (RDMA Transport, used by RNBD block storage), drivers/infiniband/ulp/rtrs/rtrs-srv.cCVE-2026-64269 · Linux kernel - RDMA/rtrs server (RDMA Transport, used by RNBD block storage), drivers/infiniband/ulp/rtrs/rtrs-srv.cCritical
• AMD Secure Processor (Ryzen / Ryzen Pro / Ryzen Mobile): Insufficient access control on the Secure Processor lets codeCVE-2018-8931 · AMD Secure Processor (Ryzen / Ryzen Pro / Ryzen Mobile)Critical