Full Report
Dell security advisory (AV26-322)
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in Dell Networking, Storage, and Infrastructure Products
## CVE Details
*Note: The source advisory AV24-188 (reported as AV26-322 in the text) refers to a collection of Dell Security Advisories. Specific individual CVE IDs are contained within the individual Dell sub-advisories.*
- **CVE ID:** Multiple (refer to Dell Security Portal)
- **CVSS Score:** Up to 9.8 (Estimated based on product types and common vulnerabilities for these suites)
- **CWE:** Varies (Includes Improper Input Validation, Buffer Overflows, and Privilege Escalation)
## Affected Systems
- **Networking:**
- Dell Networking OS10 (prior to 10.6.11)
- PowerSwitch Z9664F-ON (prior to 3.54.5.1-11)
- Connectrix Switches and Directors (prior to sannav_ova_9x_os_02_2026)
- **Data Protection:**
- Data Protection Central (19.9 to 19.12)
- PowerProtect DP Series Appliance (prior to 2.7.9)
- PowerProtect Data Manager (prior to 20.1.0.0)
- **Storage & Cloud:**
- Elastic Cloud Storage (prior to 3.8.1.7)
- ObjectScale (prior to 4.1.0.3 and 4.2.00)
- Unisphere for PowerMax Virtual Appliance (prior to 9.2.4.20)
- PowerMaxOS (prior to 10.3.0.1 patch 11248 or 5978.720.720.11249)
- Solutions Enabler (prior to 10.3.0.1 and 9.2.4.9)
- **Cloud Platform:**
- Dell APEX Cloud Platform for Microsoft Azure (prior to 01.07.01.00)
## Vulnerability Description
While the summary advisory describes a batch of updates, these vulnerabilities typically involve critical security flaws in the underlying operating systems and management interfaces of Dell’s enterprise storage and networking hardware. Common issues addressed in these bundles include fixes for third-party library vulnerabilities (OpenSSL, Linux Kernel), authentication bypasses in management consoles, and remote code execution (RCE) risks in networking protocols.
## Exploitation
- **Status:** Not currently reported as exploited in the wild (refer to individual vendor bulletins for latest updates).
- **Complexity:** Low to Medium
- **Attack Vector:** Network (primarily via management interfaces or network protocols)
## Impact
- **Confidentiality:** High
- **Integrity:** High
- **Availability:** High
## Remediation
### Patches
Dell recommends updating to the following minimum versions or later:
- **Networking OS10:** 10.6.11
- **Connectrix:** sannav_ova_9x_os_02_2026
- **Elastic Cloud Storage:** 3.8.1.7
- **ObjectScale:** 4.1.0.3 / 4.2.00
- **Data Protection Central:** Apply OS Update dpc-osupdate-1.1.26-1
- **PowerProtect Data Manager:** 20.1.0.0
- **AppSync:** 4.6.0.4
- **APEX Cloud Platform (Azure):** 01.07.01.00
- **PowerMaxOS:** 10.3.0.1 patch 11248 / 5978.720.720.11249
### Workarounds
- Restrict access to management interfaces (ports 443, 22, etc.) to trusted administrative networks only.
- Disable unused services and protocols on Networking and PowerSwitch devices.
## Detection
- **Indicators of Compromise:** Monitor for unauthorized login attempts on management consoles and unusual outbound traffic from storage appliances.
- **Detection methods:** Use vulnerability scanners (Nessus/Qualys) to check for outdated firmware signatures and version strings identified in the affected systems list.
## References
- Dell Security portal: hxxps[://]www[.]dell[.]com/support/security/en-ca
- Canadian Centre for Cyber Security Advisory: hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/dell-security-advisory-av26-322