CVE-2025-27686

LOW2.7

Dell Unisphere for PowerMax, version(s) prior to 10

Published Apr 7, 2025

Modified 9 months ago

No fix available

Details

Dell Unisphere for PowerMax, version(s) prior to 10.2.0.9 and PowerMax version(s) prior to PowerMax 9.2.4.15, contain an Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.

References

ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2025-27686 ADVISORYhttps://www.dell.com/support/kbdoc/en-ao/000302223/dsa-2025-111-dell-powermaxos-dell-powermax-eem-dell-unisphere-for-powermax-dell-unisphere-for-powermax-virtual-appliance-dell-unisphere-360-dell-solutions-enabler-and-dell-solutions-enabler-virtual-appliance-security-update-for-multiple-vulnerabilities

CVSS Analysis

CVSS v3.1

2.7

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

HighPR:H

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

LowA:L

2.7/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Weakness Type (CWE)

Other

CWE-90

Ecosystems

Timeline

PublishedApr 7, 2025

ModifiedApr 7, 2025