Objectscale
Monthly
Unauthenticated remote code execution in Dell ObjectScale affects all versions prior to 4.4.0.0, where deserialization of untrusted data (CWE-502) can let a network-reachable attacker execute arbitrary code on the appliance. Both the vendor/NVD vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and our independent assessment score the issue 10.0, reflecting low-complexity, pre-auth exploitation with full confidentiality, integrity, and availability impact and no user interaction; the practical limiting factor is exposure, since instances not reachable from the attacker's position are not exploitable. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing), and a vendor patch is available in ObjectScale 4.4.0.0.
OS Command Injection in Dell ObjectScale versions prior to 4.3.0.1 enables a low-privileged local attacker to inject arbitrary OS commands into a vulnerable management component, leading to full privilege escalation on the affected system. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that only a local low-privileged account is required - no interaction or special complexity is necessary beyond that foothold. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Dell ObjectScale (versions prior to 4.3.0.1) enables a local low-privileged attacker to write to or corrupt files outside intended directory boundaries, achieving high integrity and availability impact without requiring user interaction. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) confirms exploitation requires only a local account with minimal privilege - no elevated rights or user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is primarily from insider threats or attacker-controlled service accounts in post-compromise scenarios.
OS command injection in Dell ObjectScale versions prior to 4.3.0.1 allows a local low-privileged attacker to escalate privileges to a higher permission level by supplying crafted input that is passed unsanitized to a system shell. The CVSS 3.1 score of 7.8 (High) reflects complete compromise of confidentiality, integrity, and availability on the affected node. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis; a vendor-released patch is available via Dell Security Advisory DSA-2026-328.
OS command injection in Dell ObjectScale (versions prior to 4.3.0.1) enables a low-privileged local attacker to execute arbitrary operating system commands, yielding full confidentiality, integrity, and availability compromise of the affected node. The CVSS vector (AV:L/PR:L/UI:R) constrains exploitation to authenticated local actors who must also induce user interaction, making this a post-access lateral-movement or insider threat rather than a direct external attack path. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, though the Dell advisory DSA-2026-328 confirms the issue and provides a patch.
Privilege escalation in Dell ObjectScale versions prior to 4.3.0.1 is enabled by an Uncontrolled Search Path Element (CWE-427), allowing a low-privileged local attacker to plant a malicious binary or shared library in a directory that the application resolves before the legitimate path, resulting in code execution under a higher-privileged context. The CVSS 3.1 score of 7.3 reflects full confidentiality, integrity, and availability impact, though the attack is constrained to local access and requires user interaction to trigger the vulnerable operation. Dell has released a fix in version 4.3.0.1 per advisory DSA-2026-328; no public exploit code has been identified at time of analysis.
Privilege escalation in Dell ECS 3.8.1.0-3.8.1.7 and ObjectScale prior to 4.2.0.0 stems from hardcoded default credentials in the operating system that a remote authenticated attacker can leverage to gain elevated privileges. An attacker with low-level access can exploit this vulnerability to achieve full system compromise including confidentiality, integrity, and availability impacts. No patch is currently available for affected versions.
Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext transmission of sensitive information (CVSS 7.5).
Denial of service in Dell ObjectScale is possible in all versions prior to 4.4.0.0 when a high-privileged remote attacker abuses an incorrectly assigned permission on a critical OS-level resource, rated CVSS 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). Exploitation requires the attacker to already hold administrative privileges on the platform (PR:H), so realistic exposure is confined to insiders or adversaries who have already compromised a privileged account; only availability is meaningfully impacted, with a minor integrity effect and no confidentiality loss. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV). Dell has released a vendor patch in ObjectScale 4.4.0.0.
Local privilege escalation in Dell ECS 3.8.1.0 through 3.8.1.7 and Dell ObjectScale prior to 4.4.0.0 allows an attacker with existing high-privileged local access to elevate privileges. The flaw stems from improper privilege management (CWE-269) and requires authenticated local access (PR:H/AV:L); it is not remotely exploitable. No public exploit code or active exploitation has been identified, and vendor patches are available.
Improper authentication handling in Dell ObjectScale versions prior to 4.4.0.0 allows unauthenticated remote attackers to bypass authentication and gain unauthorized access to the platform, as reflected by a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N, with high confidentiality and integrity impact and no availability impact). No public exploit code has been identified and the CVE is not listed in CISA KEV, while CISA's SSVC assessment rates exploitation as "none" and automatable as "no"; EPSS is a low 0.48% (41st percentile), suggesting limited near-term exploitation activity. Practical risk is driven less by exploit tooling than by reachability: successful abuse requires network access to the affected ObjectScale interface, which in most enterprise deployments sits on an internal storage/management network rather than the public internet.
Information exposure affecting Dell ECS 3.8.1.0 through 3.8.1.7 and Dell ObjectScale prior to 4.4.0.0 arises from the platform's use of a broken or risky cryptographic algorithm (CWE-327). Exploitation is not remotely reachable: it requires an attacker who already holds local access to a storage node together with a high-privileged account (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N per our assessment; NVD scored the confidentiality impact as C:H under the same vector structure), so the dominant limiting factor is the privileged-local-access precondition rather than any technical barrier. There is no public exploit code identified at time of analysis and CISA SSVC rates Exploitation 'none' and Automatable 'no'; the practical risk is low, bounded by credential/algorithm hygiene on the appliance, and remediation is available via ObjectScale 4.4.0.0 and the fixed Dell ECS release cited in Dell advisory DSA-2026-393.
Dell ObjectScale versions prior to 4.3.0.1 expose sensitive information through insecure logging in the svc_tools component, enabling information disclosure to locally authenticated low-privileged users. A local attacker with minimal privileges can read svc_tools log files to extract sensitive data - potentially credentials, tokens, or internal configuration secrets - without requiring elevated permissions. No public exploit code or active exploitation has been identified at time of analysis, but the high confidentiality impact (C:H) indicates the logged data is meaningfully sensitive.
Path traversal in Dell ObjectScale before version 4.3.0.1 enables a local, low-privileged attacker to read files outside the intended directory scope, resulting in partial information disclosure. The CVSS 3.3 (Low) score reflects the constrained attack surface - local authenticated access and an existing low-privileged account are prerequisites, and impact is limited to confidentiality with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in Dell ECS Geo replication (versions 3.8.1.0-3.8.1.7) and Dell ObjectScale (prior to 4.3.0.0) allows unauthenticated remote attackers to access data in transit by exploiting assumed-immutable data assumptions. The vulnerability affects the replication authentication mechanism, enabling unauthorized data exposure without requiring valid credentials or user interaction.
Local privilege escalation in Dell Elastic Cloud Storage (≤3.8.1.7) and ObjectScale (<4.1.0.3, =4.2.0.0) allows authenticated users with low privileges to extract credentials from log files and escalate to compromised account privileges. CVSS 7.8 (High). No public exploit identified at time of analysis. EPSS data not available, but local access requirement and low attack complexity suggest moderate exploitation likelihood in multi-tenant or shared administrative environments.
Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext storage of sensitive information (CVSS 5.5).
Elastic Cloud Storage versions up to 3.8.1.7 is affected by inclusion of sensitive information in source code (CVSS 4.4).
Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext transmission of sensitive information (CVSS 6.5).
Dell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0, contain a Use of Hard-coded Cryptographic Key vulnerability. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Dell ECS version 3.8.1.4 and prior contain an Improper Certificate Validation vulnerability. Rated low severity (CVSS 3.1), this vulnerability is no authentication required. No vendor patch available.
Dell ECS version 3.8.1.4 and prior contain an Improper Input Validation vulnerability. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated remote code execution in Dell ObjectScale affects all versions prior to 4.4.0.0, where deserialization of untrusted data (CWE-502) can let a network-reachable attacker execute arbitrary code on the appliance. Both the vendor/NVD vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and our independent assessment score the issue 10.0, reflecting low-complexity, pre-auth exploitation with full confidentiality, integrity, and availability impact and no user interaction; the practical limiting factor is exposure, since instances not reachable from the attacker's position are not exploitable. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing), and a vendor patch is available in ObjectScale 4.4.0.0.
OS Command Injection in Dell ObjectScale versions prior to 4.3.0.1 enables a low-privileged local attacker to inject arbitrary OS commands into a vulnerable management component, leading to full privilege escalation on the affected system. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that only a local low-privileged account is required - no interaction or special complexity is necessary beyond that foothold. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Dell ObjectScale (versions prior to 4.3.0.1) enables a local low-privileged attacker to write to or corrupt files outside intended directory boundaries, achieving high integrity and availability impact without requiring user interaction. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) confirms exploitation requires only a local account with minimal privilege - no elevated rights or user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is primarily from insider threats or attacker-controlled service accounts in post-compromise scenarios.
OS command injection in Dell ObjectScale versions prior to 4.3.0.1 allows a local low-privileged attacker to escalate privileges to a higher permission level by supplying crafted input that is passed unsanitized to a system shell. The CVSS 3.1 score of 7.8 (High) reflects complete compromise of confidentiality, integrity, and availability on the affected node. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis; a vendor-released patch is available via Dell Security Advisory DSA-2026-328.
OS command injection in Dell ObjectScale (versions prior to 4.3.0.1) enables a low-privileged local attacker to execute arbitrary operating system commands, yielding full confidentiality, integrity, and availability compromise of the affected node. The CVSS vector (AV:L/PR:L/UI:R) constrains exploitation to authenticated local actors who must also induce user interaction, making this a post-access lateral-movement or insider threat rather than a direct external attack path. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, though the Dell advisory DSA-2026-328 confirms the issue and provides a patch.
Privilege escalation in Dell ObjectScale versions prior to 4.3.0.1 is enabled by an Uncontrolled Search Path Element (CWE-427), allowing a low-privileged local attacker to plant a malicious binary or shared library in a directory that the application resolves before the legitimate path, resulting in code execution under a higher-privileged context. The CVSS 3.1 score of 7.3 reflects full confidentiality, integrity, and availability impact, though the attack is constrained to local access and requires user interaction to trigger the vulnerable operation. Dell has released a fix in version 4.3.0.1 per advisory DSA-2026-328; no public exploit code has been identified at time of analysis.
Privilege escalation in Dell ECS 3.8.1.0-3.8.1.7 and ObjectScale prior to 4.2.0.0 stems from hardcoded default credentials in the operating system that a remote authenticated attacker can leverage to gain elevated privileges. An attacker with low-level access can exploit this vulnerability to achieve full system compromise including confidentiality, integrity, and availability impacts. No patch is currently available for affected versions.
Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext transmission of sensitive information (CVSS 7.5).
Denial of service in Dell ObjectScale is possible in all versions prior to 4.4.0.0 when a high-privileged remote attacker abuses an incorrectly assigned permission on a critical OS-level resource, rated CVSS 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). Exploitation requires the attacker to already hold administrative privileges on the platform (PR:H), so realistic exposure is confined to insiders or adversaries who have already compromised a privileged account; only availability is meaningfully impacted, with a minor integrity effect and no confidentiality loss. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV). Dell has released a vendor patch in ObjectScale 4.4.0.0.
Local privilege escalation in Dell ECS 3.8.1.0 through 3.8.1.7 and Dell ObjectScale prior to 4.4.0.0 allows an attacker with existing high-privileged local access to elevate privileges. The flaw stems from improper privilege management (CWE-269) and requires authenticated local access (PR:H/AV:L); it is not remotely exploitable. No public exploit code or active exploitation has been identified, and vendor patches are available.
Improper authentication handling in Dell ObjectScale versions prior to 4.4.0.0 allows unauthenticated remote attackers to bypass authentication and gain unauthorized access to the platform, as reflected by a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N, with high confidentiality and integrity impact and no availability impact). No public exploit code has been identified and the CVE is not listed in CISA KEV, while CISA's SSVC assessment rates exploitation as "none" and automatable as "no"; EPSS is a low 0.48% (41st percentile), suggesting limited near-term exploitation activity. Practical risk is driven less by exploit tooling than by reachability: successful abuse requires network access to the affected ObjectScale interface, which in most enterprise deployments sits on an internal storage/management network rather than the public internet.
Information exposure affecting Dell ECS 3.8.1.0 through 3.8.1.7 and Dell ObjectScale prior to 4.4.0.0 arises from the platform's use of a broken or risky cryptographic algorithm (CWE-327). Exploitation is not remotely reachable: it requires an attacker who already holds local access to a storage node together with a high-privileged account (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N per our assessment; NVD scored the confidentiality impact as C:H under the same vector structure), so the dominant limiting factor is the privileged-local-access precondition rather than any technical barrier. There is no public exploit code identified at time of analysis and CISA SSVC rates Exploitation 'none' and Automatable 'no'; the practical risk is low, bounded by credential/algorithm hygiene on the appliance, and remediation is available via ObjectScale 4.4.0.0 and the fixed Dell ECS release cited in Dell advisory DSA-2026-393.
Dell ObjectScale versions prior to 4.3.0.1 expose sensitive information through insecure logging in the svc_tools component, enabling information disclosure to locally authenticated low-privileged users. A local attacker with minimal privileges can read svc_tools log files to extract sensitive data - potentially credentials, tokens, or internal configuration secrets - without requiring elevated permissions. No public exploit code or active exploitation has been identified at time of analysis, but the high confidentiality impact (C:H) indicates the logged data is meaningfully sensitive.
Path traversal in Dell ObjectScale before version 4.3.0.1 enables a local, low-privileged attacker to read files outside the intended directory scope, resulting in partial information disclosure. The CVSS 3.3 (Low) score reflects the constrained attack surface - local authenticated access and an existing low-privileged account are prerequisites, and impact is limited to confidentiality with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in Dell ECS Geo replication (versions 3.8.1.0-3.8.1.7) and Dell ObjectScale (prior to 4.3.0.0) allows unauthenticated remote attackers to access data in transit by exploiting assumed-immutable data assumptions. The vulnerability affects the replication authentication mechanism, enabling unauthorized data exposure without requiring valid credentials or user interaction.
Local privilege escalation in Dell Elastic Cloud Storage (≤3.8.1.7) and ObjectScale (<4.1.0.3, =4.2.0.0) allows authenticated users with low privileges to extract credentials from log files and escalate to compromised account privileges. CVSS 7.8 (High). No public exploit identified at time of analysis. EPSS data not available, but local access requirement and low attack complexity suggest moderate exploitation likelihood in multi-tenant or shared administrative environments.
Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext storage of sensitive information (CVSS 5.5).
Elastic Cloud Storage versions up to 3.8.1.7 is affected by inclusion of sensitive information in source code (CVSS 4.4).
Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext transmission of sensitive information (CVSS 6.5).
Dell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0, contain a Use of Hard-coded Cryptographic Key vulnerability. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Dell ECS version 3.8.1.4 and prior contain an Improper Certificate Validation vulnerability. Rated low severity (CVSS 3.1), this vulnerability is no authentication required. No vendor patch available.
Dell ECS version 3.8.1.4 and prior contain an Improper Input Validation vulnerability. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.