EUVD-2022-37318
GHSA-g6ph-2vxq-m462
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-reachable management interface with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); authorization bypass enables unauthorized modification (I:H) with no disclosure or DoS (C:N/A:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Dell Unisphere for PowerMax vApp version prior to 10.0.0.2, contains an authorization bypass vulnerability in the Unisphere for VMAX application running in vApp
AnalysisAI
Improper authorization in Dell Unisphere for PowerMax (the VMAX management application running inside the vApp/Virtual Appliance) lets remote, unauthenticated attackers bypass access controls and perform actions or modify data they should not be permitted to reach. The CVSS 3.1 vector (C:N/I:H/A:N) scopes the impact to integrity - unauthorized state or data changes - rather than data disclosure or denial of service. No public exploit identified at time of analysis, and EPSS is very low (0.03%), consistent with CISA SSVC scoring exploitation as 'none'.
Technical ContextAI
Unisphere for PowerMax is Dell's web-based management console for PowerMax/VMAX enterprise storage arrays, typically deployed as a virtual appliance (vApp) alongside the storage fabric it administers. The flaw is classified as CWE-285 (Improper Authorization): the application performs a privileged operation without correctly verifying that the requesting principal is entitled to it, so an access-control decision that should gate an action is either missing or evaluated incorrectly. The CPE data confirms three affected code lines - dell:unisphere_for_powermax, dell:unisphere_for_powermax_virtual_appliance, and dell:unisphere_360 - indicating the authorization defect lives in shared management-plane logic common to the PowerMax administration stack rather than in a single edge component.
RemediationAI
Vendor-released patch: upgrade to a fixed build per the Dell advisory - Unisphere for PowerMax 10.0.0.5 or later (10.x line), 9.2.3.22 or later (9.x line, EEM 9.2.4.26), the Virtual Appliance to 9.2.3.22/9.2.4.26 or later, and Unisphere 360 to 9.2.3.12 or later; reconcile the exact target build with the description's 'prior to 10.0.0.2' note by confirming directly with Dell before deploying. Follow the official guidance in Dell knowledge article ka06P000000xAiKQAU (https://dellservices.lightning.force.com/lightning/r/Lightning_Knowledge__kav/ka06P000000xAiKQAU/view). Because the flaw is remotely reachable and unauthenticated, until patching completes restrict network reachability of the Unisphere management interface to a dedicated storage-administration VLAN or management jump host and block it from general user and internet-facing segments - the trade-off is that legitimate administrators must connect through that controlled path, and any automation or monitoring that reaches Unisphere directly will need its source addresses allowlisted.
More in Unisphere For Powermax
View allRemote command execution in Dell Unisphere for PowerMax versions 10.3.0.5 and prior allows a low-privileged authenticate
Dell Unisphere for PowerMax, version(s) 10.2.0.x, contain(s) an Improper Neutralization of Special Elements used in an S
Dell Unisphere for PowerMax 10.2 lacks proper authorization checks, allowing authenticated remote attackers to bypass ac
Dell Unisphere for PowerMax 10.2 contains a path traversal vulnerability that allows authenticated remote attackers to o
Dell Unisphere for PowerMax versions 10.2 suffer from a path traversal vulnerability (CWE-73) that allows authenticated
Dell Unisphere for PowerMax 10.2 contains a relative path traversal flaw that allows authenticated remote attackers to m
Unisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability. Rated high severity (CVSS
Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability. Rated high severity
Unisphere For Powermax versions up to 9.2.4.18 is affected by improper restriction of xml external entity reference (CVS
Path traversal in Dell Unisphere for PowerMax 10.3.0.5 and prior exposes arbitrary files on the underlying server to rem
Dell Unisphere for PowerMax 10.2 contains a file path control vulnerability that allows authenticated remote attackers t
Unauthorized file disclosure in Dell Unisphere for PowerMax 10.3.0.5 and prior is achievable by a remote low-privileged
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today