CVE-2022-26868

Dell EMC PowerStore versions 2.0.0.x, 2.0.1.x, and 2.1.0.x are vulnerable to a command injection flaw. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system takeover by an attacker.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://www.dell.com/support/kbdoc/000196367	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:dell:powerstoreos:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:dell:powerstore_t:-:::::::*
	cpe:2.3:h:dell:powerstore_x:-:::::::*

History

13 Jun 2022, 17:14

Type	Values Removed	Values Added
First Time		Dell powerstore X Dell powerstoreos Dell Dell powerstore T
References	~~(CONFIRM) https://www.dell.com/support/kbdoc/000196367 -~~	(CONFIRM) https://www.dell.com/support/kbdoc/000196367 - Vendor Advisory
CPE		cpe:2.3:h:dell:powerstore_t:-:::::::* cpe:2.3:o:dell:powerstoreos:::::::: cpe:2.3:h:dell:powerstore_x:-:::::::*
CWE		CWE-78
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 7.2 v3 : 7.8

02 Jun 2022, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-06-02 21:15

Updated : 2023-12-10 14:22

NVD link : CVE-2022-26868

Mitre link : CVE-2022-26868

CVE.ORG link : CVE-2022-26868

JSON object : View

Products Affected

dell

powerstoreos
powerstore_x
powerstore_t

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2022-26868", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.5}]}, "published": "2022-06-02T21:15:07.723", "references": [{"url": "https://www.dell.com/support/kbdoc/000196367", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}, {"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Dell EMC PowerStore versions 2.0.0.x, 2.0.1.x, and 2.1.0.x are vulnerable to a command injection flaw. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system takeover by an attacker."}, {"lang": "es", "value": "Dell EMC PowerStore versiones 2.0.0.x, 2.0.1.x y 2.1.0.x de Dell EMC PowerStore son vulnerables a un fallo de inyecci\u00f3n de comandos. Un atacante autenticado podr\u00eda explotar esta vulnerabilidad, conllevando a una ejecuci\u00f3n de comandos arbitrarios en el Sistema Operativo subyacente de la aplicaci\u00f3n, con los privilegios de la aplicaci\u00f3n vulnerable. La explotaci\u00f3n puede conllevar a una toma de control del sistema por parte de un atacante"}], "lastModified": "2022-06-13T17:14:20.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:powerstoreos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84872DDA-0E67-4DB0-AB9E-5FFB2392EC5F", "versionEndExcluding": "2.1.1.0", "versionStartIncluding": "2.0.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:powerstore_t:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "68266E9E-493B-4481-937A-70CD0A7C353D"}, {"criteria": "cpe:2.3:h:dell:powerstore_x:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0CB6F8F1-8856-47B8-93BD-2D3F5164ED9D"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security_alert@emc.com"}