The flaw lies in the way Dell AppSync, Metro Node, PowerMax, UCC Edge, VxRail, Unity, and PowerFlex components resolve UNIX symbolic links. If a local user can create or manipulate a symlink that points to a privileged system file and trigger the application to follow it, the attacker can write or overwrite critical configuration or system files, which enables elevation of privileges, consistent with CWE‑61 Path Traversal. The CVE description explicitly states that a low‑privileged local attacker could exploit this to gain higher privileges.

Affected products include Dell AppSync 4.6.0.0, Dell Metro Node 8.0.0, Dell UCC Edge 3.0.1, Dell VxRail 8.0.322, Dell PowerMax 10.3.0, Dell Unity 5.4, Dell PowerFlex Manager 4.5.4, Dell PowerFlex Intelligent Catalog 46.377.00 and 46.382.00, and Dell PowerFlex Rack 4.5.4 and prior versions. All listed versions run on Linux‐based systems that handle symbolic link resolution as described.

The CVSS score of 7.3 indicates moderate to high severity. The EPSS score is not available, so the current exploitation probability is uncertain; however, the vulnerability is listed in the CISA KEV catalog as not present, suggesting no confirmed exploits at this time. The likely attack vector requires local access with low privileges, making the risk contingent on the attacker’s ability to gain a foothold on the host. Abuse of the symlink following behavior can allow the attacker to modify crucial files and thereby elevate privileges, posing a significant threat to confidentiality, integrity, and availability of the affected systems.