Powerscale Insightiq
Monthly
Dell PowerScale InsightIQ versions 5.2.0 through 6.3.0 ship with an overly restrictive account lockout mechanism that an unauthenticated remote attacker can abuse to lock out accounts and degrade availability of the monitoring/management platform. The flaw is network-reachable and requires no credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3), but its impact is confined to availability - lockouts are typically temporary and recoverable, with no code execution, privilege escalation, or data exposure. No public exploit code or confirmed active exploitation was identified at time of analysis; the primary exposure driver is whether the InsightIQ authentication interface is reachable from untrusted networks rather than restricted to a management segment.
SQL injection in Dell PowerScale InsightIQ versions 5.2.0 through 6.3.0 allows an authenticated local attacker with low privileges to cause a denial of service. The vulnerability (CWE-89) requires the attacker to have a valid account on the appliance and cannot be exploited remotely. No public exploit code or active exploitation has been identified at time of analysis.
Dell PowerScale InsightIQ versions 5.2.0 through 6.3.0 ship with an overly restrictive account lockout mechanism that an unauthenticated remote attacker can abuse to lock out accounts and degrade availability of the monitoring/management platform. The flaw is network-reachable and requires no credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3), but its impact is confined to availability - lockouts are typically temporary and recoverable, with no code execution, privilege escalation, or data exposure. No public exploit code or confirmed active exploitation was identified at time of analysis; the primary exposure driver is whether the InsightIQ authentication interface is reachable from untrusted networks rather than restricted to a management segment.
SQL injection in Dell PowerScale InsightIQ versions 5.2.0 through 6.3.0 allows an authenticated local attacker with low privileges to cause a denial of service. The vulnerability (CWE-89) requires the attacker to have a valid account on the appliance and cannot be exploited remotely. No public exploit code or active exploitation has been identified at time of analysis.