EUVD-2026-60200
GHSA-h2v5-fw2x-c3hw
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Local-only attack vector and low-privilege requirement match a local OS command injection needing authenticated access; UI:R reflects the required secondary-user interaction; full C/I/A impact reflects arbitrary OS command execution on the node.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
Lifecycle Timeline
3DescriptionCVE.org
Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.
AnalysisAI
OS command injection in Dell ObjectScale (versions prior to 4.3.0.1) enables a low-privileged local attacker to execute arbitrary operating system commands, yielding full confidentiality, integrity, and availability compromise of the affected node. The CVSS vector (AV:L/PR:L/UI:R) constrains exploitation to authenticated local actors who must also induce user interaction, making this a post-access lateral-movement or insider threat rather than a direct external attack path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following conditions to be met simultaneously: (1) The attacker must have low-privilege local access to the Dell ObjectScale system - remote-only network access is insufficient, as the attack vector is strictly local (AV:L per CVSS); (2) The attacker must hold at least low-level credentials on the system (PR:L per CVSS) - unauthenticated exploitation is not possible; (3) User interaction from another user on the system must be triggered (UI:R per CVSS) - the attack is not self-sufficient and depends on a second actor performing some action, such as opening a file, viewing a log, or using an administrative interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.3 (High) reflects full C/I/A impact offset by a local attack vector (AV:L), low complexity (AC:L), low-privilege requirement (PR:L), and mandatory user interaction (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Dell ObjectScale to version 4.3.0.1 or later, as documented in Dell advisory DSA-2026-328 at https://www.dell.com/support/kbdoc/en-us/000500724/dsa-2026-328-security-update-for-dell-objectscale-multiple-proprietary-code-vulnerabilities. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit ObjectScale deployments for versions prior to 4.3.0.1 and review local access logs for suspicious activity; restrict local user access and enforce least privilege on service accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Objectscale
View allPrivilege escalation in Dell ECS 3.8.1.0-3.8.1.7 and ObjectScale prior to 4.2.0.0 stems from hardcoded default credentia
OS Command Injection in Dell ObjectScale versions prior to 4.3.0.1 enables a low-privileged local attacker to inject arb
OS command injection in Dell ObjectScale versions prior to 4.3.0.1 allows a local low-privileged attacker to escalate pr
Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext transmission of sensitive information (CVSS 7.5).
Privilege escalation in Dell ObjectScale versions prior to 4.3.0.1 is enabled by an Uncontrolled Search Path Element (CW
Path traversal in Dell ObjectScale (versions prior to 4.3.0.1) enables a local low-privileged attacker to write to or co
Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext transmission of sensitive information (CVSS 6.5).
Dell ObjectScale versions prior to 4.3.0.1 expose sensitive information through insecure logging in the svc_tools compon
Local privilege escalation in Dell Elastic Cloud Storage (≤3.8.1.7) and ObjectScale (<4.1.0.3, =4.2.0.0) allows authenti
Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext storage of sensitive information (CVSS 5.5).
Dell ECS version 3.8.1.4 and prior contain an Improper Input Validation vulnerability. Rated medium severity (CVSS 4.3),
Elastic Cloud Storage versions up to 3.8.1.7 is affected by inclusion of sensitive information in source code (CVSS 4.4)
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today