EUVD-2026-75106
GHSA-67qw-p433-v2rh
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Adjacent vector matches cluster management network scope; PR:L reflects required low-privilege authentication; impact is integrity-only (log modification) with no confidentiality or availability loss.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
3DescriptionCVE.org
Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an Incorrect Authorization vulnerability. A low privileged adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized modification of system logs.
AnalysisAI
Unauthorized system log modification in Dell PowerScale OneFS (versions 9.5.0.0-9.7.1.15, 9.8.0.0-9.13.1.0, and all versions prior to 9.15.0.0) results from an Incorrect Authorization flaw (CWE-863) that allows a low-privileged attacker with adjacency to the cluster management network to tamper with audit logs. The direct impact is limited to low-integrity loss-no confidentiality or availability exposure is confirmed-but log tampering poses a meaningful forensic risk by enabling attackers to obscure prior activity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the attacker holds a valid low-privileged account on the target Dell PowerScale OneFS cluster (CVSS PR:L - unauthenticated exploitation is not possible); (2) the attacker has network adjacency to the cluster management interface (CVSS AV:A - the vulnerability is not remotely exploitable from the open internet without first breaching network segmentation); and (3) the OneFS instance runs an affected version (9.5.0.0-9.7.1.15, 9.8.0.0-9.13.1.0, or any release prior to 9.15.0.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 3.5 (Low) is well-calibrated for this vulnerability: the adjacency requirement (AV:A) inherently limits the exposure to attackers already positioned on the storage management network, and the impact is bounded to low-integrity loss (I:L) with no confidentiality or availability dimension. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Dell PowerScale OneFS to a fixed release: 9.7.1.16 or later for environments on the 9.7.x branch, 9.13.1.1 or later for environments on the 9.13.x branch, or 9.15.0.0 or later for environments on the latest release train. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Powerscale Onefs
View allDell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.0, contains a use of default password vulnerability. Rated critic
CVE-2024-53298 is a critical missing authorization vulnerability in Dell PowerScale OneFS NFS export functionality that
Dell PowerScale OneFS, 9.5.0.x, contains a protection mechanism bypass vulnerability. Rated critical severity (CVSS 9.8)
Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain broken or risky cryptographic algorithm. Rated critical severity (C
Dell PowerScale OneFS 8.2.x through 9.6.0.x contains a use of a broken or risky cryptographic algorithm vulnerability. R
Dell PowerScale OneFS, versions 8.2.2.x-9.5.0.x, contains an improper privilege management vulnerability. Rated high sev
Dell PowerScale OneFS versions 8.1.0-9.1.0 contain an Incorrect User Management vulnerability.under some specific condit
Powerscale Onefs versions up to 9.13.0.0 is affected by improper restriction of excessive authentication attempts (CVSS
Dell PowerScale OneFS versions 8.2.x through 9.8.0.x contain a use of hard coded credentials vulnerability. Rated high s
Dell PowerScale OneFS versions 8.2.2.x through 9.6.0.x contains an improper control of a resource through its lifetime v
Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.6 and 9.11.0.0 through 9.13.0.1 contain an incorrect privilege ass
Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.2 contain an execution with unnecessary privileges vulnerability. R
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today