What is the CVSS score of CVE-2022-31231?

CVE-2022-31231 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Dell ECS are affected by CVE-2022-31231?

Dell ECS (Elastic Cloud Storage) versions 3.5 and 3.6 contain an unauthenticated access control flaw allowing remote attackers to read confidential object and storage data without credentials.. A patch is available.

How to fix or mitigate CVE-2022-31231?

Within 24 hours, audit all Dell ECS deployments to identify instances running versions 3.5 or 3.6 and assess the sensitivity of data they hold. Within 7 days, coordinate with infrastructure and change management to schedule maintenance windows and procure patched versions 3.5.1.7 or 3.6.2.4, prioritizing production systems. Within 30 days, complete deployment of patched versions across all affected instances and validate access control enforcement post-upgrade.

Dell ECS CVE-2022-31231

EUVD-2022-54113 HIGH

Improper Access Control (CWE-284)

2026-05-22 dell

GHSA-g2g3-wfq2-3g8v

Authentication Bypass Dell Ecs

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Description confirms remote unauthenticated (AV:N/PR:N/UI:N) read-only disclosure, so C:H with I:N and A:N; no evidence of increased complexity, so AC:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 16:35 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

Jul 23, 2026 - 16:22 NVD

MEDIUM HIGH

CVSS changed

Jul 23, 2026 - 16:22 NVD

5.9 (MEDIUM) 7.5 (HIGH)

Patch available

May 26, 2026 - 14:16 EUVD

CVE Published

May 22, 2026 - 14:31 cve.org

MEDIUM 5.9

DescriptionNVD

Dell ECS, versions 3.5 and 3.6, contain an Improper Access Control in the Identity and Access Management (IAM) module. A remote unauthenticated attacker may potentially exploit this vulnerability, leading to gaining read access to unauthorized data.

AnalysisAI

Broken access control in the Identity and Access Management (IAM) module of Dell ECS (Elastic Cloud Storage) 3.5 and 3.6 lets a remote, unauthenticated attacker read data they should not be able to reach. The flaw exposes confidential object/storage data without granting write or availability impact, and it is fixed in maintenance releases 3.5.1.7 and 3.6.2.4. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), consistent with CISA SSVC scoring exploitation as 'none'.

Technical ContextAI

Dell ECS is an on-premises software-defined object storage platform (S3/Swift/Atmos-compatible) used for large-scale unstructured data. The defect lives in the IAM authorization layer, which is responsible for enforcing who may access which resources. The root cause is classified as CWE-284 (Improper Access Control): an authorization decision is either missing or incorrectly enforced on a request path, so the IAM module fails to reject an unauthenticated principal before returning protected data. Because the affected component is IAM itself rather than a single API, the weakness is an authorization-enforcement gap rather than a memory-safety or injection bug. The single CPE, cpe:2.3:a:dell:ecs:*, confirms the affected software is the ECS application across the vulnerable version ranges.

RemediationAI

Vendor-released patch: upgrade Dell ECS to 3.5.1.7 or later on the 3.5 branch, or to 3.6.2.4 or later on the 3.6 branch, per Dell's advisory (https://dellservices.lightning.force.com/lightning/r/Lightning_Knowledge__kav/ka06P0000004RFTQA2/view). Because the fix corrects the IAM authorization logic itself, upgrading is the only complete remediation and there is no in-product configuration toggle that removes the flaw. Until the upgrade can be scheduled, restrict network reachability of the ECS management and S3/API endpoints to trusted administrative networks or a VPN/bastion, and place the affected interfaces behind a firewall or reverse proxy that denies unauthenticated external access - the trade-off is that legitimate remote or multi-tenant clients relying on direct internet exposure will also lose access, so validate application connectivity after tightening. Monitor ECS access logs for anonymous or unexpected read requests as a detective control while the patch is pending.