Dell ECS CVE-2026-40636

CRITICAL CONFLICT between description and CVSS vector regarding attack prerequisites. CVE description explicitly states 'unauthenticated attacker with local access' is required, meaning the attacker must first gain local system access to the storage node through other means (SSH, console, prior compromise). This implies the vulnerability is NOT directly network-exploitable and requires a foothold on the target system. However, CVSS vector AV:N/AC:L/PR:N/UI:N indicates network-based exploitation requiring no authentication, no user interaction, and low complexity - contradicting the local access requirement. Attack complexity is rated low (AC:L), suggesting no special configurations are needed once access method is achieved. No specific product features, non-default configurations, or operational modes are mentioned as prerequisites. Dell ECS and ObjectScale typically run on dedicated Linux-based appliances or virtual machines, so 'local access' likely means access to the storage node OS rather than physical hardware access. Organizations must clarify with Dell whether this vulnerability is exploitable remotely (as CVSS indicates) or requires local access (as description states) to accurately assess risk - this fundamentally changes exposure from internet-facing critical to internal lateral movement concern.

CRITICAL DATA CONFLICT: CVSS vector indicates network-based unauthenticated attack (AV:N/AC:L/PR:N/UI:N) yielding 9.8 critical severity, but the CVE description explicitly requires 'local access,' which would typically correspond to AV:L and result in significantly lower scoring (7.8 maximum for local vectors with PR:N). This discrepancy must be resolved with Dell before prioritization. If truly network-exploitable as CVSS suggests, this represents an authentication bypass allowing full system compromise of enterprise storage infrastructure - immediate patching required. If local access is genuinely required as description states, risk depends heavily on existing local access controls and whether attackers already have foothold on storage nodes. EPSS data not provided, preventing exploitation probability assessment. No CISA KEV listing indicates no confirmed widespread exploitation. The hard-coded credential class (CWE-798) is inherently high-risk in enterprise storage as credentials cannot be rotated without code/firmware changes, creating persistent backdoor risk. SSVC assessment pending clarification: if network vector confirmed, automatable exploitation against default configurations demands immediate action; if local vector, prioritize based on lateral movement risk in segmented environments.

An attacker who has gained local access to a Dell ECS or ObjectScale storage node (through compromised SSH credentials, physical access, or lateral movement from another system) discovers hard-coded credentials embedded in application binaries or configuration files. Using these credentials, the attacker authenticates to the underlying filesystem layer, bypassing application-level access controls to directly read, modify, or exfiltrate stored objects, encryption keys, and system configurations. If the CVSS network vector is accurate, a remote unauthenticated attacker could exploit this over the network without any prior access.