Command Injection Vulnerability in Dell EMC RecoverPoint Product Line

CVE-2018-1242

Summary

A command injection vulnerability exists in the Boxmgmt CLI of Dell EMC RecoverPoint, specifically impacting versions prior to 5.1.2 and RecoverPoint for VMs prior to 5.1.1.3. This flaw allows an authenticated malicious user with boxmgmt privileges to exploit the system, potentially enabling access to sensitive RPA files. However, it is important to note that files requiring root permission remain protected and cannot be accessed through this exploit. Organizations using affected versions are advised to update to the latest releases to mitigate any potential security risks.

References