A remote attacker with limited privileges can craft requests to Dell Unisphere for PowerMax that exploit an external control of file name or path flaw. This weakness, classified as CWE‑73, permits the attacker to overwrite any file the application identifies, potentially corrupting configuration files or installing malicious code. The impact is the loss of data integrity, and in a worst‑case scenario, it could compromise the entire storage system.

Dell PowerMax systems running Dell Unisphere for PowerMax version 10.2 are impacted. The vulnerability exists in both the core Unisphere product and the EEM component handling file operations.

The CVSS score of 8.8 indicates high severity, but the EPSS score of less than 1% suggests that, as of now, exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a low‑privileged attacker accessing the Unisphere web interface remotely; no exploit code is publicly documented, but the flaw can be used in a targeted attack if the attacker can reach the interface.