Threat Intelligence Database

Dell System Update versions prior to 2.3.0.0 contain an incorrect permission assignment vulnerability that allows a low privileged local attacker to potentially elevate their privileges. This vulnerability is identified as CWE-732 and has a high severity rating with a CVSS score of 8.2. Exploitation requires local access and user interaction. No patch information is currently provided.

Dell System Update versions prior to 2.3.0.0 contain an improper certificate validation vulnerability (CWE-295). This flaw could allow a highly privileged remote attacker to execute code remotely. The vulnerability is rated high severity with a CVSS score of 7.6. No patch or remediation details are provided in the input data.

Dell System Update versions prior to 2.3.0.0 contain a critical path traversal vulnerability (CWE-22) that allows an unauthenticated remote attacker to access the filesystem. This flaw can be exploited to execute arbitrary code with root privileges, potentially leading to full system compromise. Dell recommends upgrading to version 2.3.0.0 or later to remediate this issue.

Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Remote execution.

Dell OpenManage Integration with Microsoft Windows Admin Center versions prior to 3.7.0 contains an OS Command Injection vulnerability (CWE-78). This flaw allows a low privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability has a high severity with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the csi-powerflex; csi-powermax; csi-powerstore. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure.

Dell Container Storage Modules prior to version 1.18.0 have a missing authorization vulnerability in the Dell CSI Driver for PowerMax component (csireverseproxy). This flaw allows an unauthenticated attacker with adjacent network access to potentially gain unauthorized access. The vulnerability is tracked as CVE-2026-63691 and has a medium severity rating with a CVSS score of 6.1.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

Dell Container Storage Modules (CSM) versions prior to 1.18.0 have a vulnerability due to missing authentication in the csm-authorization-tenant gRPC service. This flaw allows an unauthenticated adjacent network attacker to create tenant entities, inject roles across tenants, and modify storage access control flags without authorization. The vulnerability is classified as CWE-306 and carries a high severity with a CVSS score of 7.1.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

Dell Container Storage Modules versions prior to 1.18.0 have a vulnerability involving the use of insufficiently random values. This flaw could be exploited by an unauthenticated attacker with local access to cause information tampering. The vulnerability is classified as high severity with a CVSS score of 7.7.

Dell Container Storage Modules (CSM) versions prior to 1.18.0 contain an improper certificate validation vulnerability in the proxy-server component. This flaw could allow an unauthenticated attacker on an adjacent network to expose storage backend administrator credentials. The vulnerability is identified as CWE-295 and has a high severity rating with a CVSS score of 8.2.

Dell Container Storage Modules versions prior to 1.18.0 have a critical vulnerability involving improper neutralization of special elements in a template engine. This flaw allows a low privileged remote attacker to potentially escalate privileges. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality and integrity. No known exploits are reported in the wild. The vulnerability is fixed starting from version 1.18.0.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

Dell Container Storage Modules versions prior to 1.18.0 contain a critical vulnerability due to the use of hard-coded credentials. This flaw allows an unauthenticated remote attacker to potentially gain unauthorized access, leading to information disclosure. The vulnerability is identified as CWE-798 and carries a CVSS 3.1 score of 9.8, indicating a critical severity level. No official patch or remediation details are provided in the available data.

Dell Container Storage Modules (CSM) Operator versions prior to 1.18.0 contain an improper privilege management vulnerability in the ContainerStorageModule Custom Resource reconciler. This flaw allows a low privileged remote attacker to escalate privileges and gain root-level access on cluster nodes. The vulnerability is critical with a CVSS score of 9.9.