Powerprotect Cyber Recovery
Monthly
Symlink following in Dell PowerProtect Cyber Recovery (versions prior to 20.3.0.0) enables a low-privileged local attacker to perform script injection by redirecting privileged file operations through attacker-controlled symbolic links. All three impact dimensions - confidentiality, integrity, availability - are rated High by the vendor, reflecting the potential for full local system compromise on a sensitive data-protection appliance. No public exploit exists and EPSS sits at the 2nd percentile (0.11%), with SSVC confirming no observed active exploitation, indicating limited near-term real-world risk despite the High CVSS score.
Improper authentication in Dell PowerProtect Cyber Recovery (versions prior to 20.3) allows a remote low-privileged attacker to bypass authorization controls and gain unauthorized access to the backup and recovery environment. The CVSS 8.8 High score reflects network-accessible exploitation with low attack complexity (AV:N/AC:L/PR:L), and full confidentiality, integrity, and availability impact - suggesting the attacker can read, modify, or destroy vaulted backup data. Vendor patch version 20.3.0.0 is available via Dell Security Advisory DSA-2026-370; no active exploitation has been confirmed in CISA KEV and EPSS indicates low current exploitation probability.
SQL injection in Dell PowerProtect Cyber Recovery versions 20.2 and prior enables a low-privileged remote attacker to extract sensitive information from the underlying database. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-accessible exploitation requiring only a standard user account, with high confidentiality impact and no user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity and low privilege bar make this a meaningful risk for environments running affected versions.
Dell PowerProtect Cyber Recovery, versions prior to 19.18.0.2, contains an Insertion of Sensitive Information Into Sent Data vulnerability. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
Dell Power Protect Cyber Recovery, contains an Authentication Bypass vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell PowerProtect Cyber Recovery versions before 19.11.0.2 contain an authentication bypass vulnerability. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Dell PowerProtect Cyber Recovery, versions prior to 19.11, contain a privilege escalation vulnerability on virtual appliance deployments. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Symlink following in Dell PowerProtect Cyber Recovery (versions prior to 20.3.0.0) enables a low-privileged local attacker to perform script injection by redirecting privileged file operations through attacker-controlled symbolic links. All three impact dimensions - confidentiality, integrity, availability - are rated High by the vendor, reflecting the potential for full local system compromise on a sensitive data-protection appliance. No public exploit exists and EPSS sits at the 2nd percentile (0.11%), with SSVC confirming no observed active exploitation, indicating limited near-term real-world risk despite the High CVSS score.
Improper authentication in Dell PowerProtect Cyber Recovery (versions prior to 20.3) allows a remote low-privileged attacker to bypass authorization controls and gain unauthorized access to the backup and recovery environment. The CVSS 8.8 High score reflects network-accessible exploitation with low attack complexity (AV:N/AC:L/PR:L), and full confidentiality, integrity, and availability impact - suggesting the attacker can read, modify, or destroy vaulted backup data. Vendor patch version 20.3.0.0 is available via Dell Security Advisory DSA-2026-370; no active exploitation has been confirmed in CISA KEV and EPSS indicates low current exploitation probability.
SQL injection in Dell PowerProtect Cyber Recovery versions 20.2 and prior enables a low-privileged remote attacker to extract sensitive information from the underlying database. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-accessible exploitation requiring only a standard user account, with high confidentiality impact and no user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity and low privilege bar make this a meaningful risk for environments running affected versions.
Dell PowerProtect Cyber Recovery, versions prior to 19.18.0.2, contains an Insertion of Sensitive Information Into Sent Data vulnerability. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
Dell Power Protect Cyber Recovery, contains an Authentication Bypass vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell PowerProtect Cyber Recovery versions before 19.11.0.2 contain an authentication bypass vulnerability. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Dell PowerProtect Cyber Recovery, versions prior to 19.11, contain a privilege escalation vulnerability on virtual appliance deployments. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.