CVE-2024-22454

CVE-2024-22454 describes a weak password recovery mechanism in Dell PowerProtect Data Manager versions 19.15 and prior. This vulnerability allows a remote, unauthenticated attacker to retrieve a password reset token without authorization, subsequently enabling them to change a user's password and gain unauthorized access with the compromised account's privileges. With a CVSS score of 8.8 (High), the attack requires no prior authentication and has high impacts on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.