EUVD-2026-66665
GHSA-f83j-6xvj-m95q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed PowerProtect One service
-
DeliverySend crafted malformed network request
-
ExploitTrigger stack-based buffer overflow in service
-
ExecutionCrash service process
-
ImpactDeny backup and recovery operations
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Dell PowerProtect One. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no elevated privileges, and no user interaction are required. The primary limiting factor is network reachability: an attacker must be able to reach the PowerProtect One service over the network. If the appliance management interface is not exposed to untrusted networks (e.g., isolated to a backup management VLAN), exploitation is limited to attackers with access to that network segment. No specific non-default configuration or feature enablement is identified as a prerequisite in the available data. |
| Impact | The CVSS 7.5 score reflects a high-severity denial-of-service: network-reachable (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), with high availability impact (A:H) and no confidentiality or integrity impact. This signal profile means exploitation is straightforward for any attacker with network access to the product. No EPSS data was provided in the input, and no CISA KEV listing exists, suggesting no confirmed active exploitation at time of analysis. The absence of a public POC further limits immediate mass-exploitation risk. However, backup and data protection infrastructure is high-value for ransomware actors - disrupting it prevents recovery - so the business impact of a successful DoS attack exceeds the technical severity alone. Real-world priority should be elevated for organizations where PowerProtect One is a critical recovery dependency, even absent active exploitation signals. |
| Exploit ScenarioDerived | An unauthenticated attacker with network access to a Dell PowerProtect One appliance sends a specially crafted request to the vulnerable network-facing component, triggering a stack-based buffer overflow that crashes the affected service process. This renders backup and recovery operations unavailable for the duration of the outage. No public proof-of-concept code has been identified, but the low attack complexity (AC:L) means a motivated attacker could develop a working exploit from the vulnerability description alone. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Stack-based buffer overflow in Dell PowerProtect One versions 20.1.0.0 and below enables unauthenticated remote attackers to crash the service, resulting in denial of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special network positioning, making this trivially reachable in any environment where the product is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity warrants prompt patching in environments relying on this platform for data protection.
RemediationAI
Apply the security update referenced in Dell advisory DSA-2026-369 at https://www.dell.com/support/kbdoc/en-us/000500902/dsa-2026-369-security-update-for-dell-powerprotect-one-multiple-vulnerabilities. No specific patched version number was provided in the available intelligence; consult the advisory directly to obtain the exact target release. As a compensating control pending patching, restrict network access to the PowerProtect One management interface using firewall rules or network segmentation so that only authorized management hosts can reach the exposed service - this limits the attacker pool to those with internal network access rather than any internet-facing adversary. Note that network restriction does not eliminate the vulnerability but raises the bar from unauthenticated remote to unauthenticated internal.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dell PowerProtect One is an enterprise backup and data protection appliance. CWE-121 (Stack-based Buffer Overflow) identifies the root cause: attacker-controlled input is written into a fixed-size stack buffer without adequate bounds checking, overflowing adjacent stack memory. In this case, the overflow does not yield code execution - the CVSS impact metrics show A:H with C:N and I:N - suggesting the overflow crashes the affected process or service rather than enabling arbitrary code execution. The affected software is identified by CPE cpe:2.3:a:dell:powerprotect_one:*:*:*:*:*:*:*:*, covering all versions through 20.1.0.0. The network-facing component that receives and processes the malformed input has not been further specified in available data.
Know when Powerprotect One gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable unauthenticated service with pure availability impact via process crash; no confidentiality or integrity compromise indicated.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerProtect One, versions 20.1.0.0 and below, contain a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
Executive ViewAI
A critical vulnerability in Dell PowerProtect One (versions 20.1.0.0 and below) allows any unauthenticated network user to remotely disable the service, creating immediate risk for organizations dependent on this platform for data protection and recovery operations. The lack of authentication requirements or exploitation complexity makes this trivial to exploit in production environments. Organizations must urgently identify affected systems and implement interim protections while coordinating with Dell on patch availability and upgrade paths.
Restrict network access to PowerProtect One management and service interfaces via firewall rules, limiting connectivity to authorized administrative networks and personnel only. Implement continuous monitoring and alerting for service crashes or unexpected behavior. Deploy network-based intrusion detection/prevention rules if available. Maintain offline or redundant backup verification to confirm data protection integrity during any service disruptions. These measures reduce attack surface but do not eliminate risk; vendor patch deployment remains the primary remediation path.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Powerprotect One
View allOS command injection in Dell PowerProtect One versions 20.1.0.0 and below allows remote code execution by low-privileged
OS Command Injection in Dell PowerProtect One versions 20.1.0.0 and below allows a remote low-privileged attacker to exe
Improper certificate validation in Dell PowerProtect One (versions below 20.3.0.0) enables a remote unauthenticated atta
Authorization bypass in Dell PowerProtect One versions 20.1.0.0 and below allows a remote low-privileged attacker to man
Cache poisoning in Dell PowerProtect One versions 20.1.0.0 and below exposes environments to integrity violations via an
Exploit-DB