What is the CVSS score of CVE-2022-33923?

CVE-2022-33923 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2022-33923?

Yes, a patch is available for CVE-2022-33923. Update the affected software to the latest version immediately.

Emc Powerstore 500T Firmware CVE-2022-33923

HIGH

OS Command Injection (CWE-78)

2022-07-21 security_alert@emc.com

Dell Command Injection Emc Powerstore 500T Firmware Emc Powerstore 1200T Firmware Emc Powerstore 3200T Firmware Emc Powerstore 5200T Firmware Emc Powerstore 9200T Firmware

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jul 21, 2022 - 04:15 nvd

HIGH 7.8

DescriptionNVD

Dell PowerStore, versions prior to 3.0.0.0, contains an OS Command Injection vulnerability in PowerStore T environment. A locally authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS command on the PowerStore underlying OS. Exploiting may lead to a system take over by an attacker.

AnalysisAI

Dell PowerStore, versions prior to 3.0.0.0, contains an OS Command Injection vulnerability in PowerStore T environment. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

Technical ContextAI

This vulnerability is classified as OS Command Injection (CWE-78), which allows attackers to execute arbitrary operating system commands on the host. Dell PowerStore, versions prior to 3.0.0.0, contains an OS Command Injection vulnerability in PowerStore T environment. A locally authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS command on the PowerStore underlying OS. Exploiting may lead to a system take over by an attacker. Affected products include: Dell Emc Powerstore 500T Firmware, Dell Emc Powerstore 1200T Firmware, Dell Emc Powerstore 3200T Firmware, Dell Emc Powerstore 5200T Firmware, Dell Emc Powerstore 9200T Firmware. Version information: prior to 3.0.0.0.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Avoid passing user input to shell commands. Use language-specific APIs instead of shell execution. Apply strict input validation with allowlists.