EUVD-2026-66665
GHSA-f83j-6xvj-m95q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable unauthenticated service with pure availability impact via process crash; no confidentiality or integrity compromise indicated.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
Dell PowerProtect One, versions 20.1.0.0 and below, contain a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
AnalysisAI
Stack-based buffer overflow in Dell PowerProtect One versions 20.1.0.0 and below enables unauthenticated remote attackers to crash the service, resulting in denial of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special network positioning, making this trivially reachable in any environment where the product is exposed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of Dell PowerProtect One. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 score reflects a high-severity denial-of-service: network-reachable (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), with high availability impact (A:H) and no confidentiality or integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker with network access to a Dell PowerProtect One appliance sends a specially crafted request to the vulnerable network-facing component, triggering a stack-based buffer overflow that crashes the affected service process. This renders backup and recovery operations unavailable for the duration of the outage. … |
| Remediation | Apply the security update referenced in Dell advisory DSA-2026-369 at https://www.dell.com/support/kbdoc/en-us/000500902/dsa-2026-369-security-update-for-dell-powerprotect-one-multiple-vulnerabilities. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Dell PowerProtect One instances running version 20.1.0.0 or below, map network exposure (internal-only vs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Powerprotect One
View allOS command injection in Dell PowerProtect One versions 20.1.0.0 and below allows remote code execution by low-privileged
OS Command Injection in Dell PowerProtect One versions 20.1.0.0 and below allows a remote low-privileged attacker to exe
Authorization bypass in Dell PowerProtect One versions 20.1.0.0 and below allows a remote low-privileged attacker to man
Improper certificate validation in Dell PowerProtect One versions 20.1.0.0 and below allows a network-positioned, unauth
Cache poisoning in Dell PowerProtect One versions 20.1.0.0 and below exposes environments to integrity violations via an
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today