Objectscale

Dell ObjectScale versions prior to 4.3.0.1 expose sensitive information through insecure logging in the svc_tools component, enabling information disclosure to locally authenticated low-privileged users. A local attacker with minimal privileges can read svc_tools log files to extract sensitive data - potentially credentials, tokens, or internal configuration secrets - without requiring elevated permissions. No public exploit code or active exploitation has been identified at time of analysis, but the high confidentiality impact (C:H) indicates the logged data is meaningfully sensitive.

OS Command Injection in Dell ObjectScale versions prior to 4.3.0.1 enables a low-privileged local attacker to inject arbitrary OS commands into a vulnerable management component, leading to full privilege escalation on the affected system. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that only a local low-privileged account is required - no interaction or special complexity is necessary beyond that foothold. No public exploit code or CISA KEV listing has been identified at time of analysis.

Path traversal in Dell ObjectScale (versions prior to 4.3.0.1) enables a local low-privileged attacker to write to or corrupt files outside intended directory boundaries, achieving high integrity and availability impact without requiring user interaction. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) confirms exploitation requires only a local account with minimal privilege - no elevated rights or user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is primarily from insider threats or attacker-controlled service accounts in post-compromise scenarios.

OS command injection in Dell ObjectScale versions prior to 4.3.0.1 allows a local low-privileged attacker to escalate privileges to a higher permission level by supplying crafted input that is passed unsanitized to a system shell. The CVSS 3.1 score of 7.8 (High) reflects complete compromise of confidentiality, integrity, and availability on the affected node. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis; a vendor-released patch is available via Dell Security Advisory DSA-2026-328.

OS command injection in Dell ObjectScale (versions prior to 4.3.0.1) enables a low-privileged local attacker to execute arbitrary operating system commands, yielding full confidentiality, integrity, and availability compromise of the affected node. The CVSS vector (AV:L/PR:L/UI:R) constrains exploitation to authenticated local actors who must also induce user interaction, making this a post-access lateral-movement or insider threat rather than a direct external attack path. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, though the Dell advisory DSA-2026-328 confirms the issue and provides a patch.

Privilege escalation in Dell ObjectScale versions prior to 4.3.0.1 is enabled by an Uncontrolled Search Path Element (CWE-427), allowing a low-privileged local attacker to plant a malicious binary or shared library in a directory that the application resolves before the legitimate path, resulting in code execution under a higher-privileged context. The CVSS 3.1 score of 7.3 reflects full confidentiality, integrity, and availability impact, though the attack is constrained to local access and requires user interaction to trigger the vulnerable operation. Dell has released a fix in version 4.3.0.1 per advisory DSA-2026-328; no public exploit code has been identified at time of analysis.

Path traversal in Dell ObjectScale before version 4.3.0.1 enables a local, low-privileged attacker to read files outside the intended directory scope, resulting in partial information disclosure. The CVSS 3.3 (Low) score reflects the constrained attack surface - local authenticated access and an existing low-privileged account are prerequisites, and impact is limited to confidentiality with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis.

Local privilege escalation in Dell Elastic Cloud Storage (≤3.8.1.7) and ObjectScale (<4.1.0.3, =4.2.0.0) allows authenticated users with low privileges to extract credentials from log files and escalate to compromised account privileges. CVSS 7.8 (High). No public exploit identified at time of analysis. EPSS data not available, but local access requirement and low attack complexity suggest moderate exploitation likelihood in multi-tenant or shared administrative environments.

Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext storage of sensitive information (CVSS 5.5).

Elastic Cloud Storage versions up to 3.8.1.7 is affected by inclusion of sensitive information in source code (CVSS 4.4).

Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext transmission of sensitive information (CVSS 6.5).

Privilege escalation in Dell ECS 3.8.1.0-3.8.1.7 and ObjectScale prior to 4.2.0.0 stems from hardcoded default credentials in the operating system that a remote authenticated attacker can leverage to gain elevated privileges. An attacker with low-level access can exploit this vulnerability to achieve full system compromise including confidentiality, integrity, and availability impacts. No patch is currently available for affected versions.

Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext transmission of sensitive information (CVSS 7.5).

Dell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0, contain a Use of Hard-coded Cryptographic Key vulnerability. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Dell ECS version 3.8.1.4 and prior contain an Improper Certificate Validation vulnerability. Rated low severity (CVSS 3.1), this vulnerability is no authentication required. No vendor patch available.

Dell ECS version 3.8.1.4 and prior contain an Improper Input Validation vulnerability. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.