Powerstoreos
Monthly
Dell PowerStore SDNAS (software-defined NAS) on PowerStoreOS builds earlier than 4.3.1.2-2771239 exposes a critical function that performs no authentication check, so an unauthenticated remote attacker who can reach the array's NAS service can gain full filesystem access - reading, modifying, or destroying stored data with no credentials and no user interaction (CVSS 3.1 base 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Realistic exploitation is bounded by network position: PowerStore is a datacenter storage appliance whose NAS and management interfaces are normally segmented and not internet-facing, so an attacker would generally need pre-existing access to the storage or management network segment that can reach SDNAS. No public exploit code has been identified, CISA SSVC rates exploitation as 'none', EPSS is 0.27% (20th percentile), and a vendor patch (PowerStoreOS 4.3.1.2-2771239 or later) is already available per Dell advisory DSA-2026-330.
OS command injection in Dell PowerStore allows a locally authenticated user with limited privileges to execute arbitrary commands with root privileges, achieving full appliance compromise. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 8.8) confirms low-complexity local privilege escalation with scope change to root, covering complete confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full impact triad make this a meaningful risk for environments where multiple accounts share local PowerStore access.
Arbitrary file write in Dell PowerStore allows authenticated low-privileged users to write attacker-controlled content to arbitrary filesystem paths via a Protection Mechanism Failure (CWE-693). Exploitation requires only network access and limited credentials, making this a credible lateral movement or privilege escalation vector within storage environments. No public exploit code has been identified at time of analysis, but the low complexity and low privilege bar make this a realistic threat against enterprise storage infrastructure.
Dell PowerStore, version(s) 4.0.0.0, contain(s) an Use of Hard-coded Credentials vulnerability in the PowerStore image file. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell PowerStore contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerStore versions prior to 3.5.0.1 contain an insertion of sensitive information into log file vulnerability. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell PowerStore versions 2.1.0.x contain an Authentication bypass vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Dell EMC PowerStore versions 2.0.0.x, 2.0.1.x, and 2.1.0.x are vulnerable to a command injection flaw. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell PowerStore Versions before v2.1.1.0. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
PowerStore contains Plain-Text Password Storage Vulnerability in PowerStore X & T environments running versions 2.0.0.x and 2.0.1.x A locally authenticated attacker could potentially exploit this. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerStore contains an Uncontrolled Resource Consumption Vulnerability in PowerStore User Interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Dell PowerStore SDNAS (software-defined NAS) on PowerStoreOS builds earlier than 4.3.1.2-2771239 exposes a critical function that performs no authentication check, so an unauthenticated remote attacker who can reach the array's NAS service can gain full filesystem access - reading, modifying, or destroying stored data with no credentials and no user interaction (CVSS 3.1 base 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Realistic exploitation is bounded by network position: PowerStore is a datacenter storage appliance whose NAS and management interfaces are normally segmented and not internet-facing, so an attacker would generally need pre-existing access to the storage or management network segment that can reach SDNAS. No public exploit code has been identified, CISA SSVC rates exploitation as 'none', EPSS is 0.27% (20th percentile), and a vendor patch (PowerStoreOS 4.3.1.2-2771239 or later) is already available per Dell advisory DSA-2026-330.
OS command injection in Dell PowerStore allows a locally authenticated user with limited privileges to execute arbitrary commands with root privileges, achieving full appliance compromise. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 8.8) confirms low-complexity local privilege escalation with scope change to root, covering complete confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full impact triad make this a meaningful risk for environments where multiple accounts share local PowerStore access.
Arbitrary file write in Dell PowerStore allows authenticated low-privileged users to write attacker-controlled content to arbitrary filesystem paths via a Protection Mechanism Failure (CWE-693). Exploitation requires only network access and limited credentials, making this a credible lateral movement or privilege escalation vector within storage environments. No public exploit code has been identified at time of analysis, but the low complexity and low privilege bar make this a realistic threat against enterprise storage infrastructure.
Dell PowerStore, version(s) 4.0.0.0, contain(s) an Use of Hard-coded Credentials vulnerability in the PowerStore image file. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell PowerStore contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerStore versions prior to 3.5.0.1 contain an insertion of sensitive information into log file vulnerability. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell PowerStore versions 2.1.0.x contain an Authentication bypass vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Dell EMC PowerStore versions 2.0.0.x, 2.0.1.x, and 2.1.0.x are vulnerable to a command injection flaw. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell PowerStore Versions before v2.1.1.0. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
PowerStore contains Plain-Text Password Storage Vulnerability in PowerStore X & T environments running versions 2.0.0.x and 2.0.1.x A locally authenticated attacker could potentially exploit this. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerStore contains an Uncontrolled Resource Consumption Vulnerability in PowerStore User Interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.