Cloud Disaster Recovery
Monthly
Server-Side Request Forgery in Dell Cloud Disaster Recovery versions 20.2 and prior enables a low-privileged authenticated remote attacker to coerce the server into making arbitrary outbound HTTP requests, with limited confidentiality impact per the vendor-confirmed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The vulnerability is documented in Dell advisory DSA-2026-353 and affects all releases up to and including version 20.2. No public exploit code has been identified and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
OS command injection in Dell Cloud Disaster Recovery versions 20.2 and prior allows a high-privileged remote attacker to execute arbitrary operating system commands via the product's REST API, resulting in full system compromise. The vulnerability is rooted in insufficient sanitization of special characters within API inputs (CWE-78) and is reachable over the network without user interaction. No public exploit code or active exploitation has been identified at time of analysis; Dell has released a security advisory (DSA-2026-353) addressing the issue.
OS command injection in Dell Cloud Disaster Recovery (versions 20.2 and prior) lets an already high-privileged, remote user smuggle special shell characters into a command the product executes on the underlying host, resulting in arbitrary command execution. Dell rates it CVSS 9.1 with a scope change, meaning the injected commands can escape the application's authorization boundary onto the host OS. No public exploit identified at time of analysis and the flaw is not on CISA KEV, so severity is driven by impact rather than confirmed activity.
Dell Cloud Disaster Recovery, version(s) prior to 19.20, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Server-Side Request Forgery in Dell Cloud Disaster Recovery versions 20.2 and prior enables a low-privileged authenticated remote attacker to coerce the server into making arbitrary outbound HTTP requests, with limited confidentiality impact per the vendor-confirmed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The vulnerability is documented in Dell advisory DSA-2026-353 and affects all releases up to and including version 20.2. No public exploit code has been identified and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
OS command injection in Dell Cloud Disaster Recovery versions 20.2 and prior allows a high-privileged remote attacker to execute arbitrary operating system commands via the product's REST API, resulting in full system compromise. The vulnerability is rooted in insufficient sanitization of special characters within API inputs (CWE-78) and is reachable over the network without user interaction. No public exploit code or active exploitation has been identified at time of analysis; Dell has released a security advisory (DSA-2026-353) addressing the issue.
OS command injection in Dell Cloud Disaster Recovery (versions 20.2 and prior) lets an already high-privileged, remote user smuggle special shell characters into a command the product executes on the underlying host, resulting in arbitrary command execution. Dell rates it CVSS 9.1 with a scope change, meaning the injected commands can escape the application's authorization boundary onto the host OS. No public exploit identified at time of analysis and the flaw is not on CISA KEV, so severity is driven by impact rather than confirmed activity.
Dell Cloud Disaster Recovery, version(s) prior to 19.20, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.