Dell PowerProtect One EUVD-2026-66669

Exploitation requires network-level access to a Dell PowerProtect One instance running version 20.1.0.0 or earlier, a high-complexity attack setup (AC:H per CVSS), and a victim user performing some interaction with the system (UI:R per CVSS) - the specific user action required is not detailed in available data. No authentication is required (PR:N). The exact cache component susceptible to poisoning and the precise triggering interaction are unspecified in the provided description; the vendor advisory should be consulted for specifics. Exploitation is substantially limited by the mandatory user interaction and high attack complexity, ruling out fully automated or opportunistic attacks. The impact is confined to integrity (no data exfiltration, no denial of service), further constraining the practical damage scenario.

The CVSS base score of 5.3 Medium reflects a moderately constrained risk profile. The network attack vector (AV:N) and absence of required privileges (PR:N) are offset by high attack complexity (AC:H) and mandatory user interaction (UI:R), which together make opportunistic or automated exploitation impractical. Scope is unchanged (S:U), confining impact to the vulnerable component itself. Only integrity is affected (I:H), with no confidentiality or availability impact - an important distinction given that the vendor-supplied tags include 'Information Disclosure,' which conflicts with the CVSS C:N metric; this discrepancy is unresolved from available data and should be verified against advisory DSA-2026-369. No EPSS score was provided, no public exploit code has been identified, and the CVE is not listed in CISA KEV, indicating no confirmed widespread active exploitation. Overall this is a real but moderate-priority finding: patch when feasible, but the high complexity and user-interaction requirements significantly reduce the urgency compared to a fully unauthenticated, low-complexity vulnerability.

An attacker with network access and the ability to engineer high-complexity conditions targets a user interacting with a Dell PowerProtect One appliance, manipulating an insufficiently trustworthy component to inject attacker-controlled data into the cache. Subsequent reads from that cache by the system or other users return the poisoned entries, potentially causing integrity violations such as corrupted backup metadata, malicious redirect responses, or tampered configuration data. No public exploit code exists at time of analysis, and the AC:H and UI:R requirements make this scenario unlikely to be executed opportunistically.