EUVD-2026-66703
GHSA-q6r7-22v3-jqgf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable management interface, low complexity; low privilege required as any authenticated user can trigger the injection; confidentiality-only impact matches SQL read-access scenario.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
AnalysisAI
SQL injection in Dell PowerProtect Cyber Recovery versions 20.2 and prior enables a low-privileged remote attacker to extract sensitive information from the underlying database. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-accessible exploitation requiring only a standard user account, with high confidentiality impact and no user interaction needed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged user account on the Dell PowerProtect Cyber Recovery instance (PR:L per CVSS vector), network access to the management interface (AV:N), and the target running version 20.2 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score reflects a moderate-to-elevated concern: network reachability (AV:N) and low attack complexity (AC:L) lower the exploitation bar significantly, while the low privilege requirement (PR:L) means any authenticated user - including service accounts or lower-tier operators - can trigger the flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult Dell advisory DSA-2026-370 at https://www.dell.com/support/kbdoc/en-us/000501456/dsa-2026-370-security-update-for-dell-powerprotect-cyber-recovery-multiple-third-party-component-vulnerabilities for the specific patched release - an exact fixed version number was not independently confirmed from the provided data, so organizations should treat the advisory as authoritative on the target upgrade version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Powerprotect Cyber Recovery
View allDell PowerProtect Cyber Recovery versions before 19.11.0.2 contain an authentication bypass vulnerability. Rated critica
Improper authentication in Dell PowerProtect Cyber Recovery (versions prior to 20.3) allows a remote low-privileged atta
Dell Power Protect Cyber Recovery, contains an Authentication Bypass vulnerability. Rated high severity (CVSS 8.8), this
Symlink following in Dell PowerProtect Cyber Recovery (versions prior to 20.3.0.0) enables a low-privileged local attack
Dell PowerProtect Cyber Recovery, versions prior to 19.11, contain a privilege escalation vulnerability on virtual appli
Dell PowerProtect Cyber Recovery, versions prior to 19.18.0.2, contains an Insertion of Sensitive Information Into Sent
Same weakness CWE-89 – SQL Injection
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today