While not as seemingly commonplace as the recent bundle of Lenovo software mishaps and security fumbles, rival PC OEM Dell has had to issue its own set of patches to address a potentially serious oversight.
Alongside a bushel of useful software improvements released by Dell to update its specialized drivers and software, the company is also issuing a patch for a critical oversight in its security software that has the potential to offer anyone talented enough access to exploit an infected PC and gain full control.
According to reports from Neowin, ZDNet, Digital Defense and Dell themselves, the vulnerability resides in the company’s proprietary Sonicwall Global Management System (GMS) which is typically found on PCs issued to businesses or corporate entities.
The GMS enables business customers to manage securely networked devices within an established infrastructure that may levy firewalls or VPS for compliance and data safety reasons. As for exploiting the built-in GMS, hackers can gain control of a device using the presumed hidden default account embedded in the software stack by cracking the relatively easy password manager. Once cracked and accessed, a hacker can not only control the target device but latch onto any other device connected to the network.
Vulnerabilities were found pertaining to command injection, unauthorized XXE, default account, and unauthorized modification of virtual appliance networking information.
To fix these vulnerabilities, Dell highly recommends that existing users of Dell SonicWALL GMS and Analyzer Hotfix 174525.
GMS/Analyzer/UMA Hotfix 174525 is available for download from https://www.mysonicwall.com. Users should log into MySonicWALL and click on Downloads > Download Center in the navigation panel on the left, then select GMS/Analyzer – Virtual Appliance or GMS/Analyzer – Windows in the Software Type drop down menu. Please see the Release Note for this Hotfix for detailed installation procedures.
However, according to Dell, the exploit hasn’t been tapped just yet and as of today, software patch GMS 8.0 and 8.1 are currently rolling out to potentially affected devices. While Dell customers may see the update referenced to as “highly recommended,” it is almost certain educated companies will make the update mandatory.
