Dell Unisphere for PowerMax vApp, version 9.2.4.x, contains an Improper Neutralization of Special Elements used in a Command (Command Injection) flaw. A high‑privileged attacker who can remotely access the virtual appliance can inject and execute arbitrary commands, potentially compromising the host system and gaining full control. The weakness corresponds to CWE‑77 and constitutes a classic command‑injection vulnerability.

The impacted product is Dell Unisphere for PowerMax vApp, version 9.2.4.x, which functions as a virtual appliance for managing Dell PowerMax arrays. Only installations of this specific version are affected, while later releases are presumed unaffected.

The CVSS base score of 6.6 indicates moderate severity. The EPSS score of 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. A high‑privileged attacker who can reach the appliance over the network can exploit the flaw, making the risk significant for environments where the vApp is exposed without strict access controls.