EUVD-2026-61058
GHSA-jmqg-v85x-c3gq
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NFS/RPC is inherently network-facing with no per-request authentication; AC:H reflects precision exploit requirements; full C/I/A for RCE and DoS potential.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
3DescriptionCVE.org
Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in the NFS/RPC. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution and Denial of service.
AnalysisAI
Buffer overflow in Dell PowerStore SDNAS's NFS/RPC subsystem exposes the entire PowerStore appliance line (500T through 7000T and beyond) to unauthenticated remote exploitation. The CWE-120 flaw in the RPC request handler allows an unauthenticated network attacker to achieve arbitrary command execution or denial of service against the NAS service. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The SDNAS NFS/RPC service must be provisioned and active on the PowerStore appliance - this is only the case when the NAS (file-serving) capability has been configured; appliances used exclusively for block storage (SAN-only iSCSI or Fibre Channel deployments) are not exposed to this attack vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) classifies this as High severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the security update detailed in Dell advisory DSA-2026-330 (https://www.dell.com/support/kbdoc/en-us/000497829/dsa-2026-330-dell-powerstore-t-security-update-for-multiple-vulnerabilities); an exact patched PowerStore OS version is not independently confirmed from the available input data, so consult the advisory for the specific release that resolves this issue. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Dell PowerStore SDNAS systems in your environment and implement immediate network segmentation to restrict NFS/RPC access to only authorized administrative and client networks, disabling public internet exposure where feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Powerstore 500T
View allRemote code execution and denial of service in Dell PowerStore T-series arrays (SDNAS software) stem from an out-of-boun
Unauthenticated information disclosure in Dell PowerStore T-series storage appliances allows an attacker with network ac
Privilege escalation in Dell PowerStore storage appliances allows any authenticated low-privilege user to bypass access
Privilege escalation in Dell PowerStore storage appliances allows an authenticated low-privilege user to invoke administ
Elevation of privilege in Dell PowerStore storage appliances allows a remote, low-privileged attacker to bypass authoriz
Privilege escalation to root on Dell PowerStore storage appliances allows an authenticated user with limited privileges
Command injection in Dell PowerStore storage appliances allows an authenticated low-privileged local user to execute arb
Privilege escalation in Dell PowerStore enterprise storage appliances allows authenticated low-privileged users to bypas
OS command injection in Dell PowerStore storage appliances enables a locally authenticated user with limited privileges
Code injection in Dell PowerStore storage appliances (500T through 7000T series and potentially additional models) allow
Privilege escalation to Administrator level is possible on Dell PowerStore storage appliances through an authentication
Missing authorization enforcement in Dell PowerStore storage appliances allows any attacker who has gained control of a
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today