ssh access to the ME4/U144/U840 management controller may be vulnerable to cve-2023-48795

Products

• Security Analytics

Issue/Introduction

ME4/U144/U840 management controller may be vulnerable to the cve-2023-48795 via ssh.  

Environment

Dell ME4/U144/U840

Cause

ssh is enabled by default on these devices

Resolution

ssh can be disabled in the management controller for the ME4/U144/U840 storage arrays. 

1. Login to the Web UI and select Home -> Action -> System Settings -> Services
2. Deselect SSH. 

Test by using ssh to connect to the same IP address used to access the Web UI.