EUVD-2026-42871
GHSA-r5h9-5m8h-hw64
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable command injection needing existing admin access (PR:H), no user interaction; root execution plus lateral movement into managed nodes justifies S:C and C/I/A:H.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability during OS Repository processing to achieve arbitrary command execution as root, potentially leading to full appliance compromise and lateral movement into managed infrastructure.
AnalysisAI
Root-level OS command execution in Dell PowerFlex Manager (versions prior to 5.1.0.1) lets a remote, high-privileged attacker inject operating-system commands during OS Repository processing, resulting in full appliance compromise. Because PowerFlex Manager orchestrates storage and HCI infrastructure, code execution as root also enables lateral movement into managed nodes. There is no public exploit identified at time of analysis, and Dell has released a fixed build (5.1.0.1) via advisory DSA-2026-066.
Technical ContextAI
Dell PowerFlex Manager is the management and orchestration plane for the PowerFlex (formerly ScaleIO/VxFlex) software-defined storage and hyperconverged infrastructure platform, deployed as an appliance. The flaw is a CWE-78 OS Command Injection: user-influenced input reaching the 'OS Repository' processing routine is not properly neutralized before being passed to a shell or command interpreter, so attacker-controlled special characters are interpreted as commands. The repository component typically handles OS images/packages used to provision or update managed nodes, which is why the injected commands run in the appliance's privileged (root) service context rather than a sandboxed one.
RemediationAI
Vendor-released patch: upgrade Dell PowerFlex Manager to version 5.1.0.1 or later, per Dell advisory DSA-2026-066 (https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities). Because exploitation requires high-privilege access, the most effective compensating control until patching is to tightly restrict and audit administrative/high-privilege accounts on PowerFlex Manager, remove unnecessary admin delegations, and enforce strong authentication (MFA) on management access; the trade-off is reduced operational convenience for delegated administrators. Additionally, restrict network reachability of the PowerFlex Manager management interface to a dedicated administration network or jump-host segment to shrink the set of principals who can reach the vulnerable OS Repository processing, accepting the operational cost of managing access through the bastion. These are stopgaps only - the injection itself is not eliminated without the 5.1.0.1 update.
More in Powerflex Manager
View allDell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.
SQL injection in Dell PowerFlex Manager prior to version 5.1.0.1 allows a remote, low-privileged authenticated attacker
Open redirect in Dell PowerFlex Manager versions 4.6.2 and prior lets an unauthenticated remote attacker craft a link th
Elevation of privilege in Dell PowerFlex Manager (versions <=4.6.2, including the Appliance and Rack variants) allows a
SQL injection in Dell PowerFlex Manager before 5.1.0.1 lets a low-privileged, remotely authenticated user inject crafted
Information disclosure in Dell PowerFlex Manager (Appliance, Rack, and core Manager) versions 4.6.2 and earlier allows u
Information exposure in Dell PowerFlex Manager (Appliance, Rack, and standalone) versions <=4.6.2 allows unauthenticated
Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.
Dell PowerFlex Manager, versions prior to 4.5.1.1, contain an improper certificate validation vulnerability. Rated mediu
Improper certificate validation in Dell PowerFlex Manager version 4.6.2 and earlier allows an unauthenticated attacker o
Dell PowerFlex Manager versions 4.6.2 and earlier improperly store sensitive information in a manner accessible to low-p
Insecure storage of sensitive information in Dell PowerFlex Manager versions up to and including 4.6.2 exposes credentia
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today