CVE-2021-36306
📋 TL;DR
CVE-2021-36306 is an authentication bypass vulnerability in Dell Networking OS10's RESTCONF API that allows remote unauthenticated attackers to gain unauthorized access and perform administrative actions. Affected systems are Dell Networking OS10 devices with RESTCONF API enabled prior to October 2021 patches. This vulnerability enables complete compromise of network infrastructure devices.
💻 Affected Systems
- Dell Networking OS10
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover allowing configuration changes, traffic interception, credential harvesting, and lateral movement to other network segments.
Likely Case
Unauthorized configuration changes, service disruption, and credential theft leading to network compromise.
If Mitigated
Limited impact if RESTCONF API is disabled or network access is restricted, though risk remains if exposed.
🎯 Exploit Status
Authentication bypass vulnerabilities typically have low exploitation complexity, especially with REST API endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: October 2021 updates and later
Vendor Advisory: https://www.dell.com/support/kbdoc/en-us/000193076
Restart Required: Yes
Instructions:
1. Download latest OS10 firmware from Dell support portal. 2. Backup current configuration. 3. Apply firmware update following Dell's upgrade procedures. 4. Reboot device. 5. Verify version and functionality.
🔧 Temporary Workarounds
Disable RESTCONF API
allDisable the vulnerable RESTCONF API interface if not required for operations.
configure terminal
no restconf enable
end
write memory
Restrict Network Access
allImplement network ACLs to restrict access to RESTCONF API ports (typically 443/HTTPS).
configure terminal
ip access-list standard RESTCONF-ACL
permit host [TRUSTED_IP] any
deny any any
interface [API_INTERFACE]
ip access-group RESTCONF-ACL in
end
write memory
🧯 If You Can't Patch
- Disable RESTCONF API immediately if not required for operations
- Implement strict network segmentation and firewall rules to restrict access to affected devices
🔍 How to Verify
Check if Vulnerable:
Check OS10 version with 'show version' and verify RESTCONF status with 'show restconf' - vulnerable if version predates October 2021 and RESTCONF is enabled.Check Version:
show versionVerify Fix Applied:
Verify OS10 version is October 2021 or later with 'show version' and confirm RESTCONF functionality if required.📡 Detection & Monitoring
Log Indicators:
- Unauthorized RESTCONF API access attempts
- Configuration changes from unexpected sources
- Authentication failures followed by successful API calls
Network Indicators:
- Unusual REST API traffic to OS10 devices
- HTTPS requests to RESTCONF endpoints from unauthorized sources
SIEM Query:
source="os10-logs" AND (event_type="api_access" AND user="unknown" OR event_type="config_change" AND source_ip NOT IN [admin_ips])