Cloud Disaster Recovery CVE-2026-71171

Exploitation requires remote network access to the Dell Cloud Disaster Recovery REST API endpoint and valid high-privileged (administrative) credentials, as confirmed by the CVSS vector PR:H. The attack complexity is low (AC:L) with no user interaction required (UI:N), meaning once credentials are in hand the injection is straightforward. Limiting factors: the PR:H requirement means unauthenticated exploitation is not possible under this vulnerability alone - an attacker must first compromise or possess admin-level API credentials. Versions 20.2 and prior are confirmed affected; systems already patched per DSA-2026-353 are not vulnerable.

The CVSS 7.2 score with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H reflects a balanced picture: while the attack is network-accessible with low complexity and full CIA impact, the PR:H requirement is the critical limiting signal - an attacker must first obtain high-privileged (administrative) credentials to exploit this. This is not a zero-authentication exposure. No EPSS data was provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing and no reported public exploit code further reduce near-term urgency. Real-world risk is elevated primarily for environments where admin credentials may be compromised, weak, shared, or exposed - such as misconfigured VPN-exposed management interfaces. The S:U (scope unchanged) metric indicates impact is confined to the DR appliance itself, limiting lateral risk to wider infrastructure unless the appliance has privileged reach into backup targets.

An attacker who has obtained or compromised high-privileged API credentials - through credential stuffing, phishing an admin, or reuse of credentials from another breach - sends a crafted REST API request containing shell metacharacters in a vulnerable parameter. The application passes the unsanitized input to an OS command call, causing the injected commands to execute with the privileges of the application process on the underlying server, potentially granting full control of the disaster recovery appliance.