7.8

CVE-2022-33923

Dell PowerStore, versions prior to 3.0.0.0, contains an OS Command Injection vulnerability in PowerStore T environment. A locally authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS command on the PowerStore underlying OS. Exploiting may lead to a system take over by an attacker.

Data is provided by the National Vulnerability Database (NVD)
Dell ≫ Emc Powerstore 500t Firmware Version < 3.0.0.0-1732745
   Dell ≫ Emc Powerstore 500t Version-
Dell ≫ Emc Powerstore 1200t Firmware Version < 3.0.0.0-1732745
   Dell ≫ Emc Powerstore 1200t Version-
Dell ≫ Emc Powerstore 3200t Firmware Version < 3.0.0.0-1732745
   Dell ≫ Emc Powerstore 3200t Version-
Dell ≫ Emc Powerstore 5200t Firmware Version < 3.0.0.0-1732745
   Dell ≫ Emc Powerstore 5200t Version-
Dell ≫ Emc Powerstore 9200t Firmware Version < 3.0.0.0-1732745
   Dell ≫ Emc Powerstore 9200t Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.31% 0.532
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
security_alert@emc.com 6.4 0.5 5.9
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.