EUVD-2026-68368
GHSA-6fp6-3cg6-j52w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network read (AV:N/AC:L/PR:N/UI:N) directly yields C:H, and the exposed credentials enable full administrative array control, justifying I:H/A:H.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
3DescriptionCVE.org
Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to the restricted management interface could potentially exploit this vulnerability to read internal system information from the appliance filesystem. This is a Critical vulnerability as it could expose sensitive information and credentials which allow full administrative access to the array.
AnalysisAI
Unauthenticated information disclosure in Dell PowerStore T-series storage appliances allows an attacker with network access to the restricted management interface to read arbitrary internal system information from the appliance filesystem, including stored credentials that grant full administrative control of the array. Tracked as CWE-306 (Missing Authentication for Critical Function) with a CVSS 9.8, it affects PowerStore 500T through 9200T models and is fixed per Dell advisory DSA-2026-330. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the PowerStore appliance's restricted/dedicated management interface; no authentication, credentials, or user interaction are needed once that interface is reachable (AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS score: the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects unauthenticated, low-complexity network exploitation with no user interaction, and Dell (the vendor and reporter) rates it Critical because the leaked data contains credentials that yield full array control. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: apply the fixed PowerStoreOS release covered by Dell DSA-2026-330 (https://www.dell.com/support/kbdoc/en-us/000497829/dsa-2026-330-dell-powerstore-t-security-update-for-multiple-vulnerabilities); the input data does not include an exact fixed version string, so confirm the target build directly from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Powerstore 500T
View allRemote code execution and denial of service in Dell PowerStore T-series arrays (SDNAS software) stem from an out-of-boun
Privilege escalation in Dell PowerStore storage appliances allows any authenticated low-privilege user to bypass access
Privilege escalation in Dell PowerStore storage appliances allows an authenticated low-privilege user to invoke administ
Elevation of privilege in Dell PowerStore storage appliances allows a remote, low-privileged attacker to bypass authoriz
Privilege escalation to root on Dell PowerStore storage appliances allows an authenticated user with limited privileges
Command injection in Dell PowerStore storage appliances allows an authenticated low-privileged local user to execute arb
Privilege escalation in Dell PowerStore enterprise storage appliances allows authenticated low-privileged users to bypas
OS command injection in Dell PowerStore storage appliances enables a locally authenticated user with limited privileges
Code injection in Dell PowerStore storage appliances (500T through 7000T series and potentially additional models) allow
Privilege escalation to Administrator level is possible on Dell PowerStore storage appliances through an authentication
Buffer overflow in Dell PowerStore SDNAS's NFS/RPC subsystem exposes the entire PowerStore appliance line (500T through
Missing authorization enforcement in Dell PowerStore storage appliances allows any attacker who has gained control of a
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today