EUVD-2026-66658
GHSA-hg7r-hh9h-grmm
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-accessible REST API with high-privilege requirement; full CIA impact on the appliance; no scope change beyond the vulnerable system.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
AnalysisAI
OS command injection in Dell Cloud Disaster Recovery versions 20.2 and prior allows a high-privileged remote attacker to execute arbitrary operating system commands via the product's REST API, resulting in full system compromise. The vulnerability is rooted in insufficient sanitization of special characters within API inputs (CWE-78) and is reachable over the network without user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires remote network access to the Dell Cloud Disaster Recovery REST API endpoint and valid high-privileged (administrative) credentials, as confirmed by the CVSS vector PR:H. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.2 score with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H reflects a balanced picture: while the attack is network-accessible with low complexity and full CIA impact, the PR:H requirement is the critical limiting signal - an attacker must first obtain high-privileged (administrative) credentials to exploit this. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch per Dell advisory DSA-2026-353 at https://www.dell.com/support/kbdoc/en-us/000500898/dsa-2026-353-security-update-for-cloud-disaster-recovery-vulnerabilities - the exact fixed version should be confirmed from that advisory as no specific version number was present in the available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Dell Cloud Disaster Recovery deployments at versions 20.2 and prior and validate network access controls to the product's REST API. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cloud Disaster Recovery
View allOS command injection in Dell Cloud Disaster Recovery (versions 20.2 and prior) lets an already high-privileged, remote u
Server-Side Request Forgery in Dell Cloud Disaster Recovery versions 20.2 and prior enables a low-privileged authenticat
Dell Cloud Disaster Recovery, version(s) prior to 19.20, contain(s) an Improper Neutralization of Special Elements used
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today