EUVD-2026-70329
GHSA-7fvw-crpq-x82c
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vendor description specifies a high-privileged remote attacker, overriding the AV:L/PR:L CVSS; stack overflow supports full C/I/A impact.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
4DescriptionCVE.org
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure.
AnalysisAI
Stack buffer overflow (CWE-121) in the file-level restore agent of Dell PowerProtect Data Manager versions 20.2.0.0 and below enables attackers to potentially achieve full system compromise, including code execution. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) indicates local access with low privileges, while the vendor description separately references a 'high privileged remote attacker' - a direct conflict in both attack vector and privilege level requiring vendor clarification. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Based on the provided CVSS vector (AV:L/AC:L/PR:L), exploitation requires local access to the PPDM system and at minimum a low-privilege local account - remote unauthenticated exploitation is not supported by the CVSS data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Two material conflicts in the provided metadata complicate prioritization: the CVSS vector specifies AV:L/PR:L (local access, low privilege), while the vendor description attributes exploitation to a 'high privileged remote attacker' - conflicting on both attack vector and privilege level. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patched version of Dell PowerProtect Data Manager as directed by Dell advisory DSA-2026-368 at https://www.dell.com/support/kbdoc/en-us/000501452/dsa-2026-368-security-update-for-dell-powerprotect-data-manager-multiple-vulnerabilities. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all PPDM deployments running version 20.2.0.0 or earlier and confirm whether low-privileged local access is possible in your environment; note that no public exploit identified at time of analysis. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Powerprotect Data Manager
View allElevation of privilege in Dell PowerProtect Data Manager (all versions prior to 20.2.0.0) stems from the Identity and Ac
Dell PowerProtect Data Manager, Hyper-V, version(s) 19.19 and 19.20, contain(s) an Insertion of Sensitive Information in
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgott
Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability. Rated high severity (CVSS 8
Dell PowerProtect Data Manager versions prior to 19.22 contain an incorrect privilege assignment flaw that allows remote
Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerability
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Ele
Remote code execution in Dell PowerProtect Data Manager versions prior to 20.2.0.0 stems from improper input validation
Elevation of privilege in Dell PowerProtect Data Manager versions prior to 20.2.0.0 allows an already high-privileged, r
Elevation of privilege in Dell PowerProtect Data Manager before 20.2.0.0 lets an already high-privileged, remote authent
Elevation of privilege in Dell PowerProtect Data Manager (versions prior to 20.2.0.0) allows a remote, high-privileged a
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain an OS command injection vulnerability. Rated h
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today