Unisphere For Powermax Vapp
Monthly
OS command injection in Dell Unisphere for PowerMax vApp 9.2.4.x lets a remote attacker who already holds a high-privileged (administrative) account on the appliance run arbitrary operating-system commands on the underlying host. Because the CVSS vector requires PR:H and AC:H, exploitation is gated on prior admin-level authentication plus network reachability of the Unisphere management plane and additional conditions outside the attacker's control, so the practical risk is concentrated among insiders or attackers who have already compromised privileged credentials rather than the general internet. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and the vendor has published a security-update advisory (DSA-2026-447) covering this and related PowerMax product vulnerabilities.
Path traversal in the Dell Unisphere for PowerMax vApp 9.2.4.x management appliance allows an authenticated low-privileged remote attacker to read files outside the intended restricted directory, resulting in information disclosure. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network reachability, low attack complexity, no user interaction, and confidentiality-only impact, with valid appliance credentials as the primary prerequisite for exploitation. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; risk is highest where the management interface is reachable by many lower-tier users and reduced where access is network-restricted to trusted administrators.
Command injection in Dell Unisphere for PowerMax vApp (versions 9.2.4.x) allows a high-privileged remote attacker to execute arbitrary commands, achieving remote code execution. Exploitation requires prior administrative access (PR:H) and high attack complexity (AC:H), limiting risk to insiders or attackers who have already compromised an admin account. No public exploit or active exploitation has been identified, and the CVSS score is 6.6 (moderate).
OS command injection in Dell Unisphere for PowerMax vApp 9.2.4.x lets a remote attacker who already holds a high-privileged (administrative) account on the appliance run arbitrary operating-system commands on the underlying host. Because the CVSS vector requires PR:H and AC:H, exploitation is gated on prior admin-level authentication plus network reachability of the Unisphere management plane and additional conditions outside the attacker's control, so the practical risk is concentrated among insiders or attackers who have already compromised privileged credentials rather than the general internet. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and the vendor has published a security-update advisory (DSA-2026-447) covering this and related PowerMax product vulnerabilities.
Path traversal in the Dell Unisphere for PowerMax vApp 9.2.4.x management appliance allows an authenticated low-privileged remote attacker to read files outside the intended restricted directory, resulting in information disclosure. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network reachability, low attack complexity, no user interaction, and confidentiality-only impact, with valid appliance credentials as the primary prerequisite for exploitation. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; risk is highest where the management interface is reachable by many lower-tier users and reduced where access is network-restricted to trusted administrators.
Command injection in Dell Unisphere for PowerMax vApp (versions 9.2.4.x) allows a high-privileged remote attacker to execute arbitrary commands, achieving remote code execution. Exploitation requires prior administrative access (PR:H) and high attack complexity (AC:H), limiting risk to insiders or attackers who have already compromised an admin account. No public exploit or active exploitation has been identified, and the CVSS score is 6.6 (moderate).