EUVD-2026-42872
GHSA-5hj2-5hx5-8jv3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible management interface requires valid low-privilege credentials; read-only traversal produces high confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a path traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability to read arbitrary files.
AnalysisAI
Path traversal in Dell Unisphere for PowerMax 10.3.0.5 and prior exposes arbitrary files on the underlying server to remote attackers holding low-privileged credentials. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms high confidentiality impact with no integrity or availability consequence, consistent with a read-only directory traversal flaw. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis, though the low attack complexity raises concern for rapid weaponization if credentials are compromised.
Technical ContextAI
CWE-22 (Path Traversal) describes failures to sanitize user-controlled file path inputs, allowing sequences such as '../' to escape an intended directory and reference files elsewhere on the filesystem. Dell Unisphere for PowerMax is a web-based management console for Dell PowerMax enterprise storage arrays, running as a privileged server-side process with broad filesystem access. Because storage management software frequently runs with elevated OS privileges, arbitrary file reads can expose configuration secrets, credentials, private keys, or internal API tokens. The NVD CPE and Dell advisory DSA-2026-272 (covering PowerMaxOS, PowerMax EEM, Unisphere for PowerMax, Unisphere for PowerMax Virtual Appliance, Unisphere 360, Solutions Enabler, and Solutions Enabler Virtual Appliance) indicate a broad surface area across the Dell storage management ecosystem.
RemediationAI
Upgrade Dell Unisphere for PowerMax to a version beyond 10.3.0.5 as specified in Dell advisory DSA-2026-272, available at https://www.dell.com/support/kbdoc/en-us/000483543/dsa-2026-272 - the exact fixed version should be confirmed there, as none was specified in the available intelligence data. As a compensating control pending patching, restrict network access to the Unisphere management interface to dedicated management VLANs or authenticated jump hosts, reducing the effective attack surface from the open network to a controlled environment. Enforce MFA on all Unisphere accounts to raise the bar above the PR:L threshold the attacker requires. Audit all low-privileged accounts with access to the management console and revoke any that are unused or shared. Note that network segmentation alone does not eliminate the vulnerability - it only limits who can reach the service.
More in Unisphere For Powermax
View allRemote command execution in Dell Unisphere for PowerMax versions 10.3.0.5 and prior allows a low-privileged authenticate
Dell Unisphere for PowerMax, version(s) 10.2.0.x, contain(s) an Improper Neutralization of Special Elements used in an S
Dell Unisphere for PowerMax 10.2 lacks proper authorization checks, allowing authenticated remote attackers to bypass ac
Dell Unisphere for PowerMax 10.2 contains a path traversal vulnerability that allows authenticated remote attackers to o
Dell Unisphere for PowerMax versions 10.2 suffer from a path traversal vulnerability (CWE-73) that allows authenticated
Dell Unisphere for PowerMax 10.2 contains a relative path traversal flaw that allows authenticated remote attackers to m
Unisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability. Rated high severity (CVSS
Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability. Rated high severity
Unisphere For Powermax versions up to 9.2.4.18 is affected by improper restriction of xml external entity reference (CVS
Improper authorization in Dell Unisphere for PowerMax (the VMAX management application running inside the vApp/Virtual A
Dell Unisphere for PowerMax 10.2 contains a file path control vulnerability that allows authenticated remote attackers t
Unauthorized file disclosure in Dell Unisphere for PowerMax 10.3.0.5 and prior is achievable by a remote low-privileged
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today