Product:
PowerScale InsightIQ
Summary
Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in an OS command vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to command execution. This poses a significant risk to the integrity and confidentiality of the system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.2 | CVE-2026-35071 |
Exploitation
To exploit this vulnerability, an attacker with high privileges and local access can craft specific OS commands that are improperly handled by the application. By executing these commands, the attacker can gain control over the system, potentially leading to unauthorized access and manipulation of sensitive data.
Affected Products
- PowerScale InsightIQ 6.0.0 – Vulnerable to OS command injection, allowing high privileged local attackers to execute arbitrary commands.
- PowerScale InsightIQ 6.1.0 – Same vulnerability as above, posing risks to system integrity and confidentiality.
- PowerScale InsightIQ 6.2.0 – Continues to be affected by the OS command injection vulnerability, enabling potential command execution by local attackers.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Dell PowerScale InsightIQ that addresses the OS command injection issue. Additionally, restricting local access to the system and implementing strict user privilege controls can help reduce the risk of exploitation.