Powerprotect One
Monthly
OS command injection in Dell PowerProtect One versions 20.1.0.0 and below allows remote code execution by low-privileged authenticated users. The CWE-78 root cause indicates that user-controlled input is passed unsanitized to OS-level shell commands exposed through a network-accessible interface. Dell confirmed this in advisory DSA-2026-369; no public exploit or CISA KEV listing has been identified at time of analysis, though the full C:H/I:H/A:H impact profile makes this a high priority for any organization running this data protection platform.
Improper certificate validation in Dell PowerProtect One (versions below 20.3.0.0) enables a remote unauthenticated attacker to bypass TLS certificate checks, intercepting or decrypting protected communications between the appliance and connected systems. The CVSS 3.1 base score is 7.5 with high confidentiality impact, though EPSS sits at 0.14% (4th percentile) and SSVC records exploitation as 'none,' indicating no observed threat-actor activity. Vendor patch DSA-2026-369 is available and upgrade to 20.3.0.0 or later is the primary remediation.
OS Command Injection in Dell PowerProtect One versions 20.1.0.0 and below allows a remote low-privileged attacker to execute arbitrary operating system commands on the underlying host. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-accessible exploitation requiring only a valid low-privileged credential, with full confidentiality, integrity, and availability impact on the vulnerable system. No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in Dell PowerProtect One versions 20.1.0.0 and below enables unauthenticated remote attackers to crash the service, resulting in denial of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special network positioning, making this trivially reachable in any environment where the product is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity warrants prompt patching in environments relying on this platform for data protection.
Authorization bypass in Dell PowerProtect One versions 20.1.0.0 and below allows a remote low-privileged attacker to manipulate user-controlled keys and bypass object-level authorization checks, resulting in unauthorized data tampering. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class flaw where the application trusts client-supplied identifiers without server-side authorization validation. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cache poisoning in Dell PowerProtect One versions 20.1.0.0 and below exposes environments to integrity violations via an insufficiently trustworthy component (CWE-1357), allowing a remote unauthenticated attacker to inject malicious data into the system cache when user interaction occurs. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) scores 5.3 Medium, with high attack complexity and mandatory user interaction substantially constraining real-world exploitability despite the network-accessible entry point. No public exploit code and no CISA KEV listing have been identified at time of analysis, indicating no confirmed active exploitation.
OS command injection in Dell PowerProtect One versions 20.1.0.0 and below allows remote code execution by low-privileged authenticated users. The CWE-78 root cause indicates that user-controlled input is passed unsanitized to OS-level shell commands exposed through a network-accessible interface. Dell confirmed this in advisory DSA-2026-369; no public exploit or CISA KEV listing has been identified at time of analysis, though the full C:H/I:H/A:H impact profile makes this a high priority for any organization running this data protection platform.
Improper certificate validation in Dell PowerProtect One (versions below 20.3.0.0) enables a remote unauthenticated attacker to bypass TLS certificate checks, intercepting or decrypting protected communications between the appliance and connected systems. The CVSS 3.1 base score is 7.5 with high confidentiality impact, though EPSS sits at 0.14% (4th percentile) and SSVC records exploitation as 'none,' indicating no observed threat-actor activity. Vendor patch DSA-2026-369 is available and upgrade to 20.3.0.0 or later is the primary remediation.
OS Command Injection in Dell PowerProtect One versions 20.1.0.0 and below allows a remote low-privileged attacker to execute arbitrary operating system commands on the underlying host. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-accessible exploitation requiring only a valid low-privileged credential, with full confidentiality, integrity, and availability impact on the vulnerable system. No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in Dell PowerProtect One versions 20.1.0.0 and below enables unauthenticated remote attackers to crash the service, resulting in denial of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special network positioning, making this trivially reachable in any environment where the product is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity warrants prompt patching in environments relying on this platform for data protection.
Authorization bypass in Dell PowerProtect One versions 20.1.0.0 and below allows a remote low-privileged attacker to manipulate user-controlled keys and bypass object-level authorization checks, resulting in unauthorized data tampering. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class flaw where the application trusts client-supplied identifiers without server-side authorization validation. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cache poisoning in Dell PowerProtect One versions 20.1.0.0 and below exposes environments to integrity violations via an insufficiently trustworthy component (CWE-1357), allowing a remote unauthenticated attacker to inject malicious data into the system cache when user interaction occurs. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) scores 5.3 Medium, with high attack complexity and mandatory user interaction substantially constraining real-world exploitability despite the network-accessible entry point. No public exploit code and no CISA KEV listing have been identified at time of analysis, indicating no confirmed active exploitation.