Elastic Cloud Storage Ecs
Monthly
Information exposure affecting Dell ECS 3.8.1.0 through 3.8.1.7 and Dell ObjectScale prior to 4.4.0.0 arises from the platform's use of a broken or risky cryptographic algorithm (CWE-327). Exploitation is not remotely reachable: it requires an attacker who already holds local access to a storage node together with a high-privileged account (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N per our assessment; NVD scored the confidentiality impact as C:H under the same vector structure), so the dominant limiting factor is the privileged-local-access precondition rather than any technical barrier. There is no public exploit code identified at time of analysis and CISA SSVC rates Exploitation 'none' and Automatable 'no'; the practical risk is low, bounded by credential/algorithm hygiene on the appliance, and remediation is available via ObjectScale 4.4.0.0 and the fixed Dell ECS release cited in Dell advisory DSA-2026-393.
Information exposure affecting Dell ECS 3.8.1.0 through 3.8.1.7 and Dell ObjectScale prior to 4.4.0.0 arises from the platform's use of a broken or risky cryptographic algorithm (CWE-327). Exploitation is not remotely reachable: it requires an attacker who already holds local access to a storage node together with a high-privileged account (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N per our assessment; NVD scored the confidentiality impact as C:H under the same vector structure), so the dominant limiting factor is the privileged-local-access precondition rather than any technical barrier. There is no public exploit code identified at time of analysis and CISA SSVC rates Exploitation 'none' and Automatable 'no'; the practical risk is low, bounded by credential/algorithm hygiene on the appliance, and remediation is available via ObjectScale 4.4.0.0 and the fixed Dell ECS release cited in Dell advisory DSA-2026-393.