EUVD-2026-61058
GHSA-jmqg-v85x-c3gq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed PowerStore NFS/RPC port
-
DeliverySend crafted oversized RPC payload
-
ExploitTrigger buffer overflow in SDNAS handler
-
ExecutionCorrupt memory to redirect execution
-
ImpactExecute commands as NFS daemon or crash service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The SDNAS NFS/RPC service must be provisioned and active on the PowerStore appliance - this is only the case when the NAS (file-serving) capability has been configured; appliances used exclusively for block storage (SAN-only iSCSI or Fibre Channel deployments) are not exposed to this attack vector. Exploitation requires no authentication (PR:N per CVSS, consistent with NFS host-based trust model) and no user interaction, but High Attack Complexity (AC:H) means the attacker must satisfy non-trivial technical conditions to achieve reliable memory corruption rather than a simple crash. Exploitation is further limited by: (1) network access to NFS ports (TCP/UDP 2049 and portmapper 111), which in well-architected environments is restricted to a dedicated storage VLAN; (2) the engineering effort required to bypass AC:H constraints, reducing likelihood of commodity exploitation tools; (3) the attack does not traverse scope boundaries (S:U), confining direct impact to the SDNAS subsystem. |
| Impact | The CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) classifies this as High severity. The most important moderating signal is AC:H - High Attack Complexity - which means a reliable exploit requires the attacker to engineer precise memory corruption conditions (e.g., exact heap layout, specific RPC message sequencing), substantially reducing the likelihood of mass automated exploitation compared to an AC:L counterpart. PR:N confirms no authentication is required, which is consistent with how NFS/RPC operates (host-based trust via AUTH_SYS rather than per-user credentials at the RPC layer). No EPSS score was provided in the input data. No CISA KEV listing exists for this CVE. No public exploit code has been identified. Real-world priority is moderate-to-high for organizations with PowerStore appliances serving NFS workloads, particularly those in environments where NFS ports are accessible beyond a storage VLAN. Pure block-storage deployments (iSCSI/FC only, SDNAS not provisioned) are unaffected by this attack vector. |
| Exploit ScenarioDerived | An unauthenticated attacker with network access to the PowerStore appliance's NFS/RPC listener crafts malformed RPC call packets that exceed the buffer allocated by the SDNAS request handler, triggering a memory corruption condition. Due to AC:H, the attacker must invest effort in determining the precise payload structure needed to achieve reliable code execution rather than merely crashing the service. If successful, the NFS daemon process executes attacker-supplied code, potentially enabling persistent access or data exfiltration from the storage system; a less precise exploit would crash the SDNAS NFS service, denying file access to all NFS clients. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Buffer overflow in Dell PowerStore SDNAS's NFS/RPC subsystem exposes the entire PowerStore appliance line (500T through 7000T and beyond) to unauthenticated remote exploitation. The CWE-120 flaw in the RPC request handler allows an unauthenticated network attacker to achieve arbitrary command execution or denial of service against the NAS service. The CVSS 8.1 score is tempered by High Attack Complexity (AC:H), indicating exploitation requires non-trivial payload engineering rather than a simple spray-and-pray approach; no public exploit code and no CISA KEV listing have been identified at time of analysis.
RemediationAI
Apply the security update detailed in Dell advisory DSA-2026-330 (https://www.dell.com/support/kbdoc/en-us/000497829/dsa-2026-330-dell-powerstore-t-security-update-for-multiple-vulnerabilities); an exact patched PowerStore OS version is not independently confirmed from the available input data, so consult the advisory for the specific release that resolves this issue. As a compensating control pending patching, enforce firewall or storage-network ACL rules restricting NFS portmapper (TCP/UDP 111) and NFS (TCP/UDP 2049) to only authorized NFS client subnets - note this may impact legitimate file-serving operations and should be coordinated with storage administrators. If SDNAS NFS functionality is not actively required, disabling the NFS service on the PowerStore appliance eliminates this attack surface entirely without affecting block-storage (iSCSI/FC) clients; re-enabling it later is straightforward once the patch is applied.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the SDNAS (Software-Defined NAS) component embedded in Dell PowerStore storage appliances. SDNAS exposes file-level storage via NFS (Network File System), which operates over the ONC RPC (Remote Procedure Call) framework - typically TCP/UDP port 2049 plus portmapper on port 111. CWE-120 ('Buffer Copy without Checking Size of Input') indicates the RPC request handler copies attacker-controlled input into a fixed-size buffer without length validation, enabling a classic stack or heap overflow condition. The affected CPE strings (dell:powerstore_500T, 1000T, 1200T, 3000T, 3200Q, 3200T, 5000T, 5200Q, 5200T, 7000T) identify physical storage appliance hardware, not a software-only product, meaning patching requires a coordinated firmware/OS update cycle from Dell. Tags also reference PowerStore 9000T and 9200T models not present in the CPE data, suggesting the advisory scope may be broader.
Know when Powerstore 500T gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NFS/RPC is inherently network-facing with no per-request authentication; AC:H reflects precision exploit requirements; full C/I/A for RCE and DoS potential.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in the NFS/RPC. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution and Denial of service.
Executive ViewAI
Dell PowerStore SDNAS storage arrays are vulnerable to unauthenticated remote attacks that could enable attackers to compromise data confidentiality, integrity, and availability across the entire appliance line (500T through 7000T and beyond). This represents a critical operational risk to organizations using PowerStore for business-critical NAS storage, with no vendor patch currently available. Immediate network protection measures are essential to mitigate risk while awaiting vendor remediation.
Restrict NFS/RPC access through firewall allowlists to only authorized client and management networks; disable NFS service on PowerStore systems if not required for operations; implement network-based intrusion detection systems and enhanced logging to detect exploitation attempts; enforce multi-factor authentication for all PowerStore administrative interfaces; increase backup frequency and test recovery procedures to mitigate potential denial-of-service impacts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Powerstore 500T
View allRemote code execution and denial of service in Dell PowerStore T-series arrays (SDNAS software) stem from an out-of-boun
Unauthenticated information disclosure in Dell PowerStore T-series storage appliances allows an attacker with network ac
OS command injection in Dell PowerStore storage appliances enables a locally authenticated user with limited privileges
Command injection in Dell PowerStore storage appliances allows an authenticated low-privileged local user to execute arb
Privilege escalation in Dell PowerStore storage appliances allows any authenticated low-privilege user to bypass access
Privilege escalation to Administrator level is possible on Dell PowerStore storage appliances through an authentication
Privilege escalation in Dell PowerStore storage appliances allows an authenticated low-privilege user to invoke administ
Privilege escalation in Dell PowerStore enterprise storage appliances allows authenticated low-privileged users to bypas
Elevation of privilege in Dell PowerStore storage appliances allows a remote, low-privileged attacker to bypass authoriz
Code injection in Dell PowerStore storage appliances (500T through 7000T series and potentially additional models) allow
Privilege escalation to root on Dell PowerStore storage appliances allows an authenticated user with limited privileges
Missing authorization enforcement in Dell PowerStore storage appliances allows any attacker who has gained control of a
Exploit-DB