How severe is CVE-2024-45764?

CVE-2024-45764 has a CVSS 3.x base score of 9.0, rated critical severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2024-45764 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-45764?

CVE-2024-45764 affects Dell Enterprise Sonic Distribution. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-45764?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2024-45764 have an EU (EUVD) identifier?

Yes. CVE-2024-45764 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-41587.

When was CVE-2024-45764 published?

CVE-2024-45764 was published on 2024-11-08 and last updated on 2026-06-17.

CVE-2024-45764

CVE-2024-45764 is a critical-severity vulnerability in Dell Enterprise Sonic Distribution with a CVSS 3.x base score of 9.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-304.

Key facts

Severity: Critical (CVSS 3.x base score 9.0)
EPSS exploit prediction: 1% (42nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-41587
Weakness: CWE-304
Affected product: Dell Enterprise Sonic Distribution
Published: 2024-11-08
Last modified: 2026-06-17

Description

Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. This is a critical severity vulnerability so Dell recommends customers to upgrade at the earliest opportunity.

Frequently asked questions

What is CVE-2024-45764?: Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. This is a critical severity vulnerability so Dell recommends customers to upgrade at the earliest opportunity.
How severe is CVE-2024-45764?: CVE-2024-45764 has a CVSS 3.x base score of 9.0, rated critical severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2024-45764 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-45764?: CVE-2024-45764 affects Dell Enterprise Sonic Distribution. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-45764?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2024-45764 have an EU (EUVD) identifier?: Yes. CVE-2024-45764 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-41587.
When was CVE-2024-45764 published?: CVE-2024-45764 was published on 2024-11-08 and last updated on 2026-06-17.

References

https://www.dell.com/support/kbdoc/en-us/000245655/dsa-2024-449-security-update-for-dell-enterprise-sonic-distribution-vulnerabilities

Affected products (1)

cpe:2.3:o:dell:enterprise_sonic_distribution:*:*:*:*:*:*:*:*

More vulnerabilities in Dell Enterprise Sonic Distribution

CVE-2023-32484 — Critical (CVSS 9.8): Dell Networking Switches running Enterprise SONiC versions 4.1.0, 4.0.5, 3.5.4 and below contains an improper input…
CVE-2024-45763 — Critical (CVSS 9.1): Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an…
CVE-2024-45765 — Critical (CVSS 9.1): Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an…
CVE-2025-23374 — High (CVSS 8.0): Dell Networking Switches running Enterprise SONiC OS, version(s) prior to 4.4.1 and 4.2.3, contain(s) an Insertion of…
CVE-2023-24574 — High (CVSS 7.5): Dell Enterprise SONiC OS, 3.5.3, 4.0.0, 4.0.1, 4.0.2, contains an "Uncontrolled Resource Consumption vulnerability" in…
CVE-2022-34425 — High (CVSS 7.5): Dell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH. An unauthenticated remote…

All CVEs affecting Dell Enterprise Sonic Distribution →

Other CWE-304 vulnerabilities

CVE-2024-8954 — Critical (CVSS 9.8): In composiohq/composio version 0.5.10, the API does not validate the `x-api-key` header's value during the…
CVE-2024-2172 — Critical (CVSS 9.8): The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to…
CVE-2026-61466 — Critical (CVSS 9.1): In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope`…
CVE-2026-67351 — High (CVSS 8.8): Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and…
CVE-2026-76207 — High (CVSS 8.1): phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued…
CVE-2026-42452 — High (CVSS 8.1): Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to…

Browse all CWE-304 vulnerabilities →