Product:
ECS and ObjectScale
Summary
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0 contain a vulnerability due to improper neutralization of formula elements in a CSV file within the UI. An unauthenticated attacker with remote access could exploit this vulnerability, potentially leading to remote execution. This poses a risk to the integrity and confidentiality of the affected systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.8 | CVE-2026-35157 |
Exploitation
To exploit this vulnerability, an attacker must have remote access to the affected system and must be able to interact with the user interface. By crafting a malicious CSV file that takes advantage of the improper neutralization, the attacker can execute arbitrary code on the system. This requires a high level of attack complexity and user interaction, making it less likely but still possible.
Affected Products
- Dell ECS versions 3.8.1.0 through 3.8.1.7: These versions are vulnerable due to improper handling of CSV files in the UI.
- Dell ObjectScale versions prior to 4.3.0.0: Earlier versions are also affected by the same vulnerability, allowing for potential remote execution.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest versions of Dell ECS and ObjectScale that are not affected by this issue. Regularly applying security updates and patches is essential to protect against known vulnerabilities. Additionally, restricting remote access and monitoring user interactions can help reduce the risk of exploitation.