Product:
PowerProtect Data Manager
Summary
Dell PowerProtect Data Manager prior to version 19.22 contains an Improper Verification of Source of a Communication Channel vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass. This could allow unauthorized access to sensitive data and system controls.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.7 | CVE-2026-22266 |
Exploitation
To exploit this vulnerability, an attacker with high privileges and remote access can send crafted requests to the REST API of the affected product. By bypassing the verification mechanisms, the attacker can manipulate the communication channel, potentially gaining unauthorized access to the system and its data.
Affected Products
- Dell PowerProtect Data Manager: Versions prior to 19.22 are affected by the vulnerability, allowing for potential exploitation through the REST API.
Mitigation
To mitigate this vulnerability, users should upgrade to Dell PowerProtect Data Manager version 19.22 or later. This update addresses the improper verification issue and enhances the security of the REST API, reducing the risk of exploitation.