CVE-2022-26868

Vulnerability

A command injection vulnerability exists in Dell EMC PowerStore versions 2.0.0.x, 2.0.1.x, and 2.1.0.x. The flaw allows an authenticated attacker to inject arbitrary OS commands into the application's underlying operating system, which are then executed with the privileges of the vulnerable application [1].

Exploitation

To exploit this vulnerability, an attacker must first authenticate to the PowerStore system. The attacker then sends crafted input to a vulnerable component or function, which is not properly sanitized, leading to command injection. No user interaction beyond authentication is required for exploitation [1].

Impact

Successful exploitation enables the attacker to execute arbitrary OS commands on the underlying operating system. This can lead to full compromise of the affected system, including data disclosure, alteration, or denial of service, and potentially a complete system takeover [1].

Mitigation

Dell EMC has addressed this vulnerability in a security update. Affected users should apply the latest patches as provided in the Dell Security Advisory [1]. No workarounds have been disclosed; upgrading to a fixed version is the recommended mitigation.