This vulnerability (CWE-1236) in Dell ECS and Dell ObjectScale products arises from improper neutralization of formula elements in CSV files processed or displayed in the UI. This flaw could allow an unauthenticated remote attacker to inject malicious formulas into CSV files, potentially leading to remote code execution when such files are handled. The affected versions are Dell ECS 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0. The CVSS v3.1 base score is 5.8, indicating medium severity with network attack vector, high attack complexity, no privileges required, and user interaction required.

Successful exploitation could result in limited confidentiality, integrity, and availability impacts due to potential remote code execution via malicious CSV formula injection. However, exploitation requires user interaction and has high attack complexity. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, organizations should monitor Dell's advisories for updates. Until a patch is available, restrict access to affected versions where possible and exercise caution when handling CSV files from untrusted sources.