Product:
PowerProtect Agent Service
Summary
Dell PowerProtect Agent Service prior to version 20.1 contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure. This could allow unauthorized access to sensitive data.
Details
| Severity | Base Score | CVE |
|---|---|---|
| LOW | 3.3 | CVE-2026-28264 |
Exploitation
To exploit this vulnerability, an attacker with local access can manipulate permissions on critical resources. By doing so, they can gain unauthorized access to sensitive information that should be protected. This requires low privileges, making it easier for attackers to exploit the vulnerability if they have physical or local access to the system.
Affected Products
- PowerProtect Agent Service: Versions prior to 20.1 are affected by this vulnerability, allowing low privileged attackers to exploit permission issues.
Mitigation
To mitigate this vulnerability, users should upgrade to version 20.1 or later of the PowerProtect Agent Service. Regularly reviewing and updating permissions for critical resources can also help prevent unauthorized access. It is important to monitor systems for any suspicious activity that may indicate exploitation attempts.