CVE-2022-26870

Vulnerability

CVE-2022-26870 is an authentication bypass vulnerability in Dell PowerStore versions 2.1.0.x [1]. Under a specific configuration, a remote unauthenticated attacker can bypass authentication mechanisms [1]. The affected versions are explicitly 2.1.0.x [1].

Exploitation

An attacker does not need any prior authentication or local access; the vulnerability is exploitable from the network [1]. The specific set of configuration conditions required is not detailed in the reference, but the advisory states that it is exploitable under "specific configuration" [1]. No user interaction or privilege escalation path is described.

Impact

Successful exploitation grants the attacker unauthorized access to the system [1]. The impact is potentially critical, as the attacker gains access without authentication, which could lead to full compromise of the affected PowerStore appliance, including confidentiality, integrity, and availability impacts [1].

Mitigation

The vulnerability is addressed in PowerStore version 2.1.1.0 and later [1]. Dell recommends upgrading to a fixed version as soon as possible [1]. No workarounds are provided in the advisory.