EUVD-2026-42875
GHSA-rhg3-7wm6-r85w
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable management API requires authenticated low-privileged session (PR:L); AC:H reflects unspecified exploitation prerequisites; C:H only as XXE enables server-side file read with no write or availability impact.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
Lifecycle Timeline
2DescriptionCVE.org
Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
AnalysisAI
Unauthorized file disclosure in Dell Unisphere for PowerMax 10.3.0.5 and prior is achievable by a remote low-privileged attacker via an XML External Entity (XXE) injection flaw (CWE-611). By submitting crafted XML containing external entity declarations to a vulnerable parsing endpoint, an authenticated attacker can cause the server to read and return sensitive local files or initiate server-side requests, resulting in High confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Dell has issued advisory DSA-2026-272 covering this and related vulnerabilities across the PowerMax product family.
Technical ContextAI
Dell Unisphere for PowerMax is a web-based management console for Dell PowerMax enterprise storage arrays, commonly deployed in large data center environments to provision and monitor storage resources. CWE-611 (Improper Restriction of XML External Entity Reference) describes a server-side parsing defect where an XML processor honors external entity declarations (<!ENTITY xxe SYSTEM 'file:///etc/passwd'>) embedded in user-controlled XML input. When the Unisphere XML parser processes such input without disabling DOCTYPE declarations or external entity resolution, it fetches the referenced URI server-side and may include the result in the response - enabling local file read or SSRF. The CVSS vector (AV:N/PR:L) confirms the vulnerability is reachable over the network by authenticated low-privileged users, consistent with a management API endpoint accepting XML payloads. The advisory DSA-2026-272 also covers related products including PowerMaxOS, EEM, Unisphere 360, Solutions Enabler, and their virtual appliance variants, suggesting a shared XML parsing component or library may underlie the broader advisory scope.
RemediationAI
Consult Dell advisory DSA-2026-272 at https://www.dell.com/support/kbdoc/en-us/000483543/ to obtain and apply the vendor-released patch addressing this vulnerability. A specific fixed version number was not independently confirmed in the available intelligence - the exact target upgrade version must be verified against the Dell advisory before initiating patching, as the advisory covers multiple products. As a compensating control prior to patching, restrict network access to the Unisphere for PowerMax management interface to trusted administrator subnets using firewall or network ACLs; this reduces the attack surface by limiting which authenticated users can reach the vulnerable XML endpoint, though it does not eliminate the flaw and carries the trade-off of reduced operational accessibility. Additionally, blocking outbound connections from the Unisphere server to untrusted networks can prevent SSRF-style external entity fetching (where the XXE causes the server to reach external URIs), but will not prevent local file read exploitation. Neither compensating control substitutes for the vendor patch.
More in Unisphere For Powermax
View allRemote command execution in Dell Unisphere for PowerMax versions 10.3.0.5 and prior allows a low-privileged authenticate
Dell Unisphere for PowerMax, version(s) 10.2.0.x, contain(s) an Improper Neutralization of Special Elements used in an S
Dell Unisphere for PowerMax 10.2 lacks proper authorization checks, allowing authenticated remote attackers to bypass ac
Dell Unisphere for PowerMax 10.2 contains a path traversal vulnerability that allows authenticated remote attackers to o
Dell Unisphere for PowerMax versions 10.2 suffer from a path traversal vulnerability (CWE-73) that allows authenticated
Dell Unisphere for PowerMax 10.2 contains a relative path traversal flaw that allows authenticated remote attackers to m
Unisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability. Rated high severity (CVSS
Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability. Rated high severity
Unisphere For Powermax versions up to 9.2.4.18 is affected by improper restriction of xml external entity reference (CVS
Improper authorization in Dell Unisphere for PowerMax (the VMAX management application running inside the vApp/Virtual A
Path traversal in Dell Unisphere for PowerMax 10.3.0.5 and prior exposes arbitrary files on the underlying server to rem
Dell Unisphere for PowerMax 10.2 contains a file path control vulnerability that allows authenticated remote attackers t
Share
External POC / Exploit Code
Leaving vuln.today