Threat database

Dell PowerProtect One versions 20.1.0.0 and below contain a stack-based buffer overflow vulnerability (CWE-121). This flaw could be exploited remotely by an unauthenticated attacker to cause a denial of service condition. The vulnerability has a high severity rating with a CVSS score of 7.5. No official patch or remediation guidance has been provided yet by the vendor. There are no known exploits in the wild at this time.

Dell Cloud Disaster Recovery versions 20.2 and prior contain a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-71172). This vulnerability allows a low privileged attacker with remote access to potentially perform SSRF attacks. The CVSS score is 4.3, indicating a medium severity risk. No official remediation or patch information is currently available.

Dell Cloud Disaster Recovery versions 20.2 and earlier contain an OS Command Injection vulnerability in the REST API. This flaw allows a high privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability is identified as CWE-78 and has a CVSS 3.1 score of 7.2, indicating high severity. No official patch or remediation guidance has been provided yet. There are no known exploits in the wild at this time.

Dell Cloud Disaster Recovery versions 20.2 and earlier contain an OS Command Injection vulnerability (CWE-78). A high privileged attacker with remote access could exploit this flaw to execute arbitrary commands on the affected system. The vulnerability has a critical severity with a CVSS score of 9.1, indicating high impact on confidentiality, integrity, and availability.

Dell iDRAC9 versions prior to 7.00.00.182 for 14G and prior to 7.20.30.50 for 15G/16G contain an improper access control vulnerability. This flaw could allow an unauthenticated remote attacker to gain unauthorized access to data. The vulnerability has a medium severity with a CVSS score of 5.9. No official patch or remediation level has been confirmed yet.

Dell Alienware Area 51m R2 BIOS contains a vulnerability involving improper link resolution before file access, allowing a low privileged local attacker to potentially perform arbitrary writes. This issue arises from the creation of temporary files in directories with insecure permissions. The vulnerability has a medium severity rating with a CVSS score of 6.6.

Dell ThinOS 10 versions prior to 2605_10.2518 contain an improper access control vulnerability (CWE-284) that allows a low privileged local attacker to gain unauthorized access. This vulnerability has a high severity with a CVSS score of 7.8. No official patch or remediation guidance has been confirmed yet.

Dell Command Update (DCU), versions prior to 5.7.1, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

Dell Command Update (DCU) versions prior to 5.7.1 have an incorrect default permissions vulnerability (CWE-276). This flaw allows a low privileged local attacker to gain unauthorized filesystem access. The vulnerability has a high severity with a CVSS score of 7.8. No explicit patch links are provided, but versions 5.7.1 and later are not affected.

Dell Command Update (DCU) versions prior to 5.7.1 contain an XML External Entity (XXE) vulnerability (CWE-611). This flaw allows a low privileged local attacker to potentially perform server-side request forgery and elevate privileges. The vulnerability has a medium severity with a CVSS score of 6.5. No official patch link is provided in the data, but versions 5.7.1 and later are implied to have the fix.

Dell Command Update (DCU) versions prior to 5.7.1 contain a missing authorization vulnerability (CWE-862). This flaw allows a low privileged local attacker to potentially elevate their privileges. The vulnerability has a high severity with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability if exploited.

Dell Command Update (DCU) versions prior to 5.7.1 contain an incorrect authorization vulnerability (CWE-863). This flaw allows a low privileged local attacker to potentially elevate their privileges. The vulnerability does not impact confidentiality or availability but can impact integrity. The CVSS 3.1 base score is 5.5 (medium severity).

Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

Dell Command Update (DCU), versions prior to 5.7.1, contain an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.

Dell Command Update (DCU) versions prior to 5.7.1 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. This flaw allows a low privileged local attacker to potentially elevate their privileges. The vulnerability is identified as CWE-367 and has a high severity rating with a CVSS score of 7.3. It requires local access and user interaction to exploit. No official patch information is provided in the input data.

Dell Command Update (DCU) versions prior to 5.7.1 contain a deserialization of untrusted data vulnerability (CWE-502). This flaw allows a low privileged local attacker to potentially elevate their privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7.8. No specific patch link is provided, but the vulnerability is fixed starting from version 5.7.1.

Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

Dell Command Update (DCU) versions prior to 5.7.1 contain a vulnerability involving improper link resolution before file access. This flaw could allow a low privileged local attacker to potentially elevate their privileges on the affected system. The vulnerability is identified as CWE-59 and is classified with a medium severity rating.

Dell RecoverPoint for Virtual Machines versions prior to 6.1 contain an OS Command Injection vulnerability (CWE-78). This flaw allows a high-privileged remote attacker to execute arbitrary commands on the affected system without user interaction. The vulnerability is rated high severity with a CVSS score of 7.2.