EUVD-2025-210917
GHSA-pfqv-f769-7m67
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Local access with high privileges (PR:H) matches vendor; downgraded C:H→C:L because 'information exposure' via weak crypto lacks evidence of full/high-value disclosure.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Use of a Broken or Risky Cryptographic Algorithm vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
AnalysisAI
Information exposure affecting Dell ECS 3.8.1.0 through 3.8.1.7 and Dell ObjectScale prior to 4.4.0.0 arises from the platform's use of a broken or risky cryptographic algorithm (CWE-327). Exploitation is not remotely reachable: it requires an attacker who already holds local access to a storage node together with a high-privileged account (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N per our assessment; NVD scored the confidentiality impact as C:H under the same vector structure), so the dominant limiting factor is the privileged-local-access precondition rather than any technical barrier. There is no public exploit code identified at time of analysis and CISA SSVC rates Exploitation 'none' and Automatable 'no'; the practical risk is low, bounded by credential/algorithm hygiene on the appliance, and remediation is available via ObjectScale 4.4.0.0 and the fixed Dell ECS release cited in Dell advisory DSA-2026-393.
Technical ContextAI
The root cause is CWE-327, Use of a Broken or Risky Cryptographic Algorithm, in Dell's scale-out object storage platforms. Dell ECS (Elastic Cloud Storage) and its successor ObjectScale use cryptography for several internal functions - protecting stored credentials and configuration secrets, key material handling for encryption at rest, and integrity/authentication of administrative sessions - and at least one of those routines relies on an algorithm the vendor now classifies as weak or risky. Because the weakness is in the algorithm selection rather than in memory handling or an input-validation path, the practical consequence is disclosure of data the algorithm was supposed to protect to someone who can already observe or act inside the appliance. The CPE string recorded for this issue, cpe:2.3:a:dell:elastic_cloud_storage_(ecs):*:*:*:*:*:*:*:*, does not pin a version, so version scoping must come from Dell's own guidance: ECS 3.8.1.0-3.8.1.7 and ObjectScale releases before 4.4.0.0. The CVSS vector AV:L/PR:H with S:U shows the exploit is confined to the component that already handles the privileged local context, and the differing confidentiality ratings (NVD C:H versus our C:L) reflect uncertainty about how much protected material a given deployment actually exposes - the confidentiality outcome depends on which cryptographic asset in the deployment is using the risky algorithm and on what that asset guards.
RemediationAI
Upgrade Dell ObjectScale to version 4.4.0.0 or later, which removes the risky cryptographic algorithm condition, and for Dell ECS 3.8.1.0-3.8.1.7 apply the fixed release identified in Dell advisory DSA-2026-393 (https://www.dell.com/support/kbdoc/en-in/000505935/dsa-2026-393-security-update-for-dell-objectscale-multiple-vulnerabilities); confirm the exact ECS target build in that advisory before scheduling the upgrade, since the input data names 4.4.0.0 explicitly only for ObjectScale. Because a patch-application window on a storage cluster can be long, interim compensating controls should focus on the actual precondition - a high-privileged local account - by inventorying and reducing the number of administrative/operator accounts with node-level shell or console access, enforcing MFA and just-in-time elevation for those accounts, disabling or tightly scoping vendor support/debug shells, and alerting on new or unusual local logins and on key-material or credential-store access (trade-off: these controls add operational friction for storage administrators and cannot fully substitute for the algorithm fix if the protected asset is already being read). Where deployment-specific cryptographic material is implicated, rotate administrative credentials, session secrets, and any keys managed by the appliance after upgrading, accepting that rotation causes brief service or re-authentication disruption. Network segmentation and blocking management-plane ports from untrusted segments are useful hardening but do not address this CVE, because the vector requires local privileged access (PR:H, AV:L) and no remote or unauthenticated path is described.
More in Objectscale
View allUnauthenticated remote code execution in Dell ObjectScale affects all versions prior to 4.4.0.0, where deserialization o
Privilege escalation in Dell ECS 3.8.1.0-3.8.1.7 and ObjectScale prior to 4.2.0.0 stems from hardcoded default credentia
Improper authentication in Dell ObjectScale versions prior to 4.4.0.0 allows remote, unauthenticated attackers to bypass
OS Command Injection in Dell ObjectScale versions prior to 4.3.0.1 enables a low-privileged local attacker to inject arb
OS command injection in Dell ObjectScale versions prior to 4.3.0.1 allows a local low-privileged attacker to escalate pr
Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext transmission of sensitive information (CVSS 7.5).
OS command injection in Dell ObjectScale (versions prior to 4.3.0.1) enables a low-privileged local attacker to execute
Privilege escalation in Dell ObjectScale versions prior to 4.3.0.1 is enabled by an Uncontrolled Search Path Element (CW
Path traversal in Dell ObjectScale (versions prior to 4.3.0.1) enables a local low-privileged attacker to write to or co
Local privilege escalation in Dell ECS 3.8.1.0 through 3.8.1.7 and Dell ObjectScale prior to 4.4.0.0 allows an attacker
Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext transmission of sensitive information (CVSS 6.5).
Dell ObjectScale versions prior to 4.3.0.1 expose sensitive information through insecure logging in the svc_tools compon
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today