Virtual Storage Integrator For Vmware Vsphere Client
Monthly
Sensitive information disclosure in Dell Virtual Storage Integrator (VSI) for VMware vSphere Client, all versions prior to 10.11.1.0, lets an unauthenticated remote attacker retrieve active session credentials and hijack authenticated sessions, including those of administrators. Because stolen session tokens grant full impersonation of legitimate users, Dell rates this critical (CVSS 9.8); there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the SSVC framework flags it as automatable with total technical impact. EPSS remains low at 0.39% (32nd percentile), consistent with the absence of observed exploitation to date.
Remote code execution in Dell Virtual Storage Integrator (VSI) for VMware vSphere Client, all versions prior to 10.11.1.0, lets an unauthenticated remote attacker inject OS commands through the IAPI component and run them as root on the appliance's host OS. Because the flaw requires no authentication and no user interaction over the network, it enables full compromise of the VSI deployment and the storage infrastructure it manages. No public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated root RCE make this a top-priority patch.
Sensitive information disclosure in Dell Virtual Storage Integrator (VSI) for VMware vSphere Client, all versions prior to 10.11.1.0, lets an unauthenticated remote attacker retrieve active session credentials and hijack authenticated sessions, including those of administrators. Because stolen session tokens grant full impersonation of legitimate users, Dell rates this critical (CVSS 9.8); there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the SSVC framework flags it as automatable with total technical impact. EPSS remains low at 0.39% (32nd percentile), consistent with the absence of observed exploitation to date.
Remote code execution in Dell Virtual Storage Integrator (VSI) for VMware vSphere Client, all versions prior to 10.11.1.0, lets an unauthenticated remote attacker inject OS commands through the IAPI component and run them as root on the appliance's host OS. Because the flaw requires no authentication and no user interaction over the network, it enables full compromise of the VSI deployment and the storage infrastructure it manages. No public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated root RCE make this a top-priority patch.