Description

Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-17T14:20:21.193Z",
  "pubdate": "2026-08-17T14:20:21.193Z",
  "executiveSummary": "An Improper Neutralization of Special Elements used in an OS Command vulnerability, classified as OS Command Injection, has been identified in Dell ObjectScale in versions prior to 4.3.0.1.\nThe vulnerability allows a low-privileged attacker with local access to execute arbitrary OS commands on the underlying operating system.\nSuccessful exploitation of this flaw can lead to unauthorized system command execution, potentially compromising the integrity, confidentiality, and availability of the affected host environment.\nThe risk implication is severe, as local attackers can escalate their capabilities or interact directly with the underlying operating system context through the vulnerable application interface.\nExploitation requires the attacker to possess local access to the system and low privileges, indicating that the vulnerability is typically leveraged post-authentication or via local interaction vectors within the affected product environment.",
  "technicalDetails": "The vulnerability is rooted in the improper neutralization of special elements utilized in operating system commands, a flaw commonly known as OS Command Injection.\nThe affected component within Dell ObjectScale fails to adequately sanitize or validate user-supplied input before passing it to downstream system shells or execution functions.\nAffected versions include all deployments of Dell ObjectScale prior to version 4.3.0.1.\nExploitation requires the attacker to have local access and low privileges on the target system.\nThe attack flow begins when an attacker supplies specially crafted input containing malicious shell metacharacters or command separators to the vulnerable interface or component.\nBecause the application does not properly neutralize these special elements, the underlying operating system interprets the injected strings as executable commands rather than literal data parameters.\nWhen the affected component processes the input, it hands off the concatenated command string to the host operating system shell for execution.\nThis results in the execution of arbitrary commands with the privilege level of the application process or the context in which the command interpreter is invoked.\nPost-exploitation impact includes arbitrary command execution on the host, potential privilege escalation, unauthorized access to sensitive system resources, and full compromise of the affected ObjectScale node depending on the execution context."
}