EUVD-2026-66706
GHSA-32xm-hgp4-xgc5
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
Local-only attack path with low privileges; AC:H reflects TOCTOU race condition; I:H because script injection can overwrite critical files; C and A impacts minor.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection.
AnalysisAI
Symlink following in Dell PowerProtect Cyber Recovery versions prior to 20.3 allows a local low-privileged attacker to redirect privileged file operations to attacker-controlled paths, resulting in script injection. The CVSS vector (AV:L/AC:H/PR:L) confirms the attack is constrained to local access with elevated complexity - likely a race condition - but the integrity impact is rated High, meaning successful exploitation can alter critical scripts or configurations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker to have an active local user account on the Dell PowerProtect Cyber Recovery host with at least low-privilege access (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS score of 5.8 (Medium) reflects a meaningful but constrained attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privileged local account on the PowerProtect Cyber Recovery host identifies a directory writable by their user account that a privileged PowerProtect process is known to access during scheduled backup or recovery operations. The attacker replaces a legitimate file in that path with a symlink pointing to a sensitive system script or cron file. … |
| Remediation | Upgrade Dell PowerProtect Cyber Recovery to version 20.3 or later, as confirmed by Dell Security Advisory DSA-2026-370 (https://www.dell.com/support/kbdoc/en-us/000501456/dsa-2026-370-security-update-for-dell-powerprotect-cyber-recovery-multiple-third-party-component-vulnerabilities). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection
d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote at
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Same weakness CWE-61 – UNIX Symbolic Link (Symlink) Following
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today