EUVD-2026-80834
GHSA-c4qj-8235-frwj
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Retained PR:H because a high-privileged actor is explicitly required and DoS-only impact (A:H, I:L, C:N); kept AV:N per vendor though 'in the OS' framing makes local plausible.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell ObjectScale, versions prior to 4.4.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability in the OS. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
AnalysisAI
Denial of service in Dell ObjectScale is possible in all versions prior to 4.4.0.0 when a high-privileged remote attacker abuses an incorrectly assigned permission on a critical OS-level resource, rated CVSS 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). Exploitation requires the attacker to already hold administrative privileges on the platform (PR:H), so realistic exposure is confined to insiders or adversaries who have already compromised a privileged account; only availability is meaningfully impacted, with a minor integrity effect and no confidentiality loss. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold high/administrative privileges on the Dell ObjectScale platform (PR:H) and to reach the affected OS-level resource; the flaw stems from an incorrect (overly permissive) permission assignment on a critical OS resource in ObjectScale versions prior to 4.4.0.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Dell ObjectScale to version 4.4.0.0 or later; this is the vendor-released fix and the only complete remediation, documented in Dell security advisory DSA-2026-393 (https://www.dell.com/support/kbdoc/en-in/000505935/dsa-2026-393-security-update-for-dell-objectscale-multiple-vulnerabilities). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Objectscale
View allUnauthenticated remote code execution in Dell ObjectScale affects all versions prior to 4.4.0.0, where deserialization o
Privilege escalation in Dell ECS 3.8.1.0-3.8.1.7 and ObjectScale prior to 4.2.0.0 stems from hardcoded default credentia
Improper authentication in Dell ObjectScale versions prior to 4.4.0.0 allows remote, unauthenticated attackers to bypass
OS Command Injection in Dell ObjectScale versions prior to 4.3.0.1 enables a low-privileged local attacker to inject arb
OS command injection in Dell ObjectScale versions prior to 4.3.0.1 allows a local low-privileged attacker to escalate pr
Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext transmission of sensitive information (CVSS 7.5).
OS command injection in Dell ObjectScale (versions prior to 4.3.0.1) enables a low-privileged local attacker to execute
Privilege escalation in Dell ObjectScale versions prior to 4.3.0.1 is enabled by an Uncontrolled Search Path Element (CW
Path traversal in Dell ObjectScale (versions prior to 4.3.0.1) enables a local low-privileged attacker to write to or co
Local privilege escalation in Dell ECS 3.8.1.0 through 3.8.1.7 and Dell ObjectScale prior to 4.4.0.0 allows an attacker
Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext transmission of sensitive information (CVSS 6.5).
Dell ObjectScale versions prior to 4.3.0.1 expose sensitive information through insecure logging in the svc_tools compon
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today