Technical impact
Dell PowerScale InsightIQ systems that run versions 6.0.0 through 6.2.0 contain an OS Command Injection weakness caused by improper neutralization of special elements used in a command string (CWE‑78). When a high‑privileged user with local access submits data that is incorporated directly into an operating‑system command, the system may execute arbitrary commands chosen by the attacker. This flaw allows the attacker to gain full control over the affected host, enabling data exfiltration, alteration, or denial of service.
Affected Systems
The vulnerability affects Dell’s PowerScale InsightIQ product, specifically all releases from version 6.0.0 up to and including 6.2.0. Any deployment of these versions is potentially susceptible if the exposed interface remains accessible to users with elevated local privileges.
Risk and Exploitability
The CVSS score of 8.2 indicates a high severity of impact, though the EPSS score is currently unavailable and the flaw is not listed in the CISA KEV catalog. Exploitation requires a local, high‑privileged account on the InsightIQ system, meaning that the attacker must already have significant access. Once logged in, the attacker can execute arbitrary OS commands, compromising the integrity and availability of the system and potentially enabling further lateral movement within the environment.
