EUVD-2026-66656
GHSA-p7qv-h32g-j27p
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Remote (AV:N) but gated by high app privileges (PR:H); low complexity and no UI; command injection breaks from app scope to host OS (S:C) with full C/I/A impact.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
AnalysisAI
OS command injection in Dell Cloud Disaster Recovery (versions 20.2 and prior) lets an already high-privileged, remote user smuggle special shell characters into a command the product executes on the underlying host, resulting in arbitrary command execution. Dell rates it CVSS 9.1 with a scope change, meaning the injected commands can escape the application's authorization boundary onto the host OS. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires high-privileged, authenticated access to Dell Cloud Disaster Recovery (CVSS PR:H) reachable over the network (AV:N); it is not remote-unauthenticated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1) shows network reachability, low complexity, no user interaction, full C/I/A impact, and a scope change - but PR:H is the decisive limiter: exploitation presupposes an attacker who already holds high privileges within the product. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the update referenced in Dell advisory DSA-2026-353 (https://www.dell.com/support/kbdoc/en-us/000500898/dsa-2026-353-security-update-for-cloud-disaster-recovery-vulnerabilities); patch available per vendor advisory, though the exact fixed version is not stated in the source data and should be taken from the advisory itself. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Dell Cloud Disaster Recovery systems running version 20.2 or earlier and restrict administrative access to CDR interfaces through network-level controls and IP whitelisting. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cloud Disaster Recovery
View allOS command injection in Dell Cloud Disaster Recovery versions 20.2 and prior allows a high-privileged remote attacker to
Server-Side Request Forgery in Dell Cloud Disaster Recovery versions 20.2 and prior enables a low-privileged authenticat
Dell Cloud Disaster Recovery, version(s) prior to 19.20, contain(s) an Improper Neutralization of Special Elements used
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today