EUVD-2026-69149
GHSA-mxfv-63r7-pcpx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAcquire limited local appliance credentials
-
DeliveryAuthenticate to PowerStore management CLI
-
ExploitIdentify input parameter passed to OS shell
-
ExecutionInject shell metacharacters into parameter
-
PersistOS executes attacker payload as root
-
ImpactFull storage appliance compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a locally authenticated session on the Dell PowerStore appliance with at minimum low-privilege credentials (PR:L per CVSS vector). The attack vector is local (AV:L), meaning network-only access is insufficient - the attacker must have authenticated access to the appliance's management CLI or local management interface. No user interaction by a privileged user is required (UI:N) once local access is established, and no special non-default configuration is indicated. Exploitation is limited by the need to first acquire local credentials; unauthenticated remote exploitation is not supported by the available data. |
| Impact | The CVSS 3.1 score of 8.8 is driven by full C/H/I/A impact combined with a scope change (S:C), reflecting that a limited local account can escalate to root on a storage platform where data from multiple dependent systems may reside. The local vector (AV:L) and low privilege requirement (PR:L) constrain the attack - an adversary must first obtain an authenticated local session before exploiting this flaw. No KEV listing and no public exploit code identified at time of analysis, reducing immediate urgency compared to remotely exploitable issues. However, storage appliances are high-value targets: root access implies full access to volume data, management credentials, and potential lateral movement to connected SAN/NAS hosts. The low attack complexity (AC:L) means exploitation requires no special conditions beyond authenticated access, and the scope change elevates residual risk for environments with multiple administrative personas sharing appliance access. |
| Exploit ScenarioDerived | An attacker who has obtained a limited-privilege local account on a Dell PowerStore appliance - through credential theft, insider access, or lateral movement from a connected management host - identifies an injectable parameter in the management CLI or appliance management interface. By supplying a crafted value containing shell metacharacters (e.g., semicolons, backticks, or subshell expressions), the attacker causes the appliance to execute arbitrary OS commands in a root context, achieving full control of the storage platform. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
OS command injection in Dell PowerStore storage appliances enables a locally authenticated user with limited privileges to execute arbitrary commands at the root level, achieving full privilege escalation on the appliance. The CVSS scope change (S:C) reflects that root access on a storage platform extends impact beyond the immediate process boundary to the entire appliance and potentially dependent workloads. Dell has published advisory DSA-2026-330, but no specific patched version was provided in available data. No public exploit identified at time of analysis.
RemediationAI
Consult Dell advisory DSA-2026-330 directly at https://www.dell.com/support/kbdoc/en-us/000497829/dsa-2026-330-dell-powerstore-t-security-update-for-multiple-vulnerabilities for specific patched PowerStore OS versions; no fixed version number was included in the available intelligence data, so the advisory is the authoritative source. As a compensating control pending patching, restrict limited-privilege local accounts on PowerStore appliances to only the personnel who strictly require them, auditing all accounts with local shell or management CLI access. Enforce multi-factor authentication on the management interface if supported, and monitor appliance audit logs for anomalous command execution patterns. Note that account restriction limits the attack surface but does not remediate the underlying injection flaw.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 (Improper Neutralization of Special Elements used in an OS Command) describes failures to sanitize user-supplied input before passing it to an OS shell interpreter. In this case, the Dell PowerStore management layer - which runs on a Linux-based appliance OS - appears to accept user input in a privileged execution context without adequate shell metacharacter filtering. The affected product line spans the full T-series and Q-series PowerStore storage appliances as enumerated in CPE data: PowerStore 500T, 1000T, 1200T, 3000T, 3200Q, 3200T, 5000T, 5200Q, 5200T, and 7000T. The local attack vector (AV:L) confirms the injection surface is accessible to authenticated local users rather than exposed over the network unauthenticated.
Know when Powerstore 500T gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local authenticated access with low privileges is required; scope change reflects root escalation impacting the full appliance beyond the calling process.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
Executive ViewAI
Dell PowerStore storage appliances are vulnerable to privilege escalation (CVE-2026-58571, CVSS 8.8) that allows authenticated local users to gain root access, compromising the entire appliance and dependent workloads. Organizations using PowerStore systems face complete storage platform compromise if local access is breached or misused. Urgent action is required to restrict local access and enable monitoring, as no vendor patch is currently available.
Restrict local authentication to authorized administrators only; implement privileged access management (PAM) solutions to control and audit root-level access; enable comprehensive audit logging of all local sessions and commands; use network segmentation to limit direct access to PowerStore console or management ports; conduct quarterly access reviews to remove unnecessary local user accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
More in Powerstore 500T
View allRemote code execution and denial of service in Dell PowerStore T-series arrays (SDNAS software) stem from an out-of-boun
Unauthenticated information disclosure in Dell PowerStore T-series storage appliances allows an attacker with network ac
Command injection in Dell PowerStore storage appliances allows an authenticated low-privileged local user to execute arb
Privilege escalation in Dell PowerStore storage appliances allows any authenticated low-privilege user to bypass access
Privilege escalation to Administrator level is possible on Dell PowerStore storage appliances through an authentication
Privilege escalation in Dell PowerStore storage appliances allows an authenticated low-privilege user to invoke administ
Privilege escalation in Dell PowerStore enterprise storage appliances allows authenticated low-privileged users to bypas
Elevation of privilege in Dell PowerStore storage appliances allows a remote, low-privileged attacker to bypass authoriz
Code injection in Dell PowerStore storage appliances (500T through 7000T series and potentially additional models) allow
Privilege escalation to root on Dell PowerStore storage appliances allows an authenticated user with limited privileges
Buffer overflow in Dell PowerStore SDNAS's NFS/RPC subsystem exposes the entire PowerStore appliance line (500T through
Missing authorization enforcement in Dell PowerStore storage appliances allows any attacker who has gained control of a
Exploit-DB