This vulnerability (CWE-1236) in Dell ECS and Dell ObjectScale products arises from improper neutralization of formula elements in CSV files processed by the UI. An unauthenticated attacker with remote access could exploit this flaw to execute code remotely. The affected versions are Dell ECS 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0. The CVSS 3.1 base score is 5.8, reflecting network attack vector, high attack complexity, no privileges required, required user interaction, and partial confidentiality, integrity, and availability impacts. No patch or official remediation level has been published by Dell as of the data provided.

Successful exploitation could lead to remote code execution by an unauthenticated attacker, potentially compromising confidentiality, integrity, and availability of the affected system. The impact is rated medium severity with partial loss of these security properties. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. Avoid processing untrusted CSV files in the affected versions and consider restricting remote access to the UI if possible.