CVE-2022-22557

Vulnerability

Dell PowerStore X and T environments running versions 2.0.0.x and 2.0.1.x contain a plain-text password storage vulnerability [1]. The affected software stores certain user credentials in an unencrypted form, making them accessible to an attacker with local access to the system.

Exploitation

An attacker must have local authentication to the PowerStore system (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) [1]. With high privileges, the attacker can read the stored plain-text passwords from the system's configuration or database files. No user interaction is required.

Impact

Successful exploitation leads to the disclosure of user credentials [1]. The attacker can then use these credentials to access the vulnerable application with the privileges of the compromised account, potentially gaining full control over the system (high confidentiality, integrity, and availability impact) [1].

Mitigation

Dell has released a security update as part of DSA-2022-014 to address this vulnerability [1]. Users should upgrade to the latest version of PowerStore. No workaround is available. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.