Description

Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Insertion of Sensitive Information into Log File vulnerability in the svc_tools. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-17T14:20:21.770Z",
  "pubdate": "2026-08-17T14:20:21.770Z",
  "executiveSummary": "Dell ObjectScale in versions prior to 4.3.0.1 contains an Insertion of Sensitive Information into Log File vulnerability located within the svc_tools component. This security flaw enables a low-privileged threat actor possessing local access to compromise confidentiality by potentially exposing sensitive operational or system data written insecurely to log files. The risk implication centers on unauthorized information disclosure, which could assist further compromise phases against the underlying host environment. Exploitation of this vulnerability requires local authentication and low privileges on the target system, meaning an attacker must already have established an interactive or programmatic session on the node hosting the vulnerable software. The primary defensive remediation involves updating the affected product to version 4.3.0.1 or later where the issue is addressed.",
  "technicalDetails": "The vulnerability is classified as an Insertion of Sensitive Information into Log File weakness, residing within the svc_tools component of Dell ObjectScale versions prior to 4.3.0.1. The root cause stems from insecure coding practices wherein sensitive data processed by diagnostic or service utilities is improperly sanitized or explicitly written to plain-text system log files without adequate access controls or cryptographic masking. The vulnerable component, svc_tools, executes administrative or diagnostic routines that inadvertently capture and persist confidential state parameters, credentials, or operational secrets into persistent logging storage. To exploit this flaw, an attacker must first obtain local access to the target host running the affected Dell ObjectScale software. Given that low privileges are sufficient, an authenticated user with minimal access rights can inspect these log files if file-system permissions are overly permissive or if the logging mechanism exposes records across privilege boundaries. The attack flow proceeds as follows: first, the attacker authenticates locally with low privileges; second, the attacker executes or waits for the execution of svc_tools routines that generate the verbose or improperly redacted log entries; third, the attacker reads the target log files within the file system; and finally, the attacker harvests the exposed sensitive information contained within the logs. The post-exploitation impact is strictly localized to information disclosure, though the harvested data may include tokens, internal configuration parameters, or credentials that facilitate privilege escalation or lateral movement within the broader infrastructure. Network exposure is not a strict requirement for initial access, as the threat vector relies on local access capabilities."
}