Dell ObjectScale versions before 4.3.0.1 contain an OS Command Injection flaw that allows a low‑privileged local user to supply unsanitized input to system commands, potentially leading to elevation of privileges. The vulnerability is a classic case of Improper Neutralization of Special Elements used in an OS Command (CWE‑78). While the description only specifies local access, the impact on confidentiality, integrity, or availability is that an attacker could execute arbitrary commands on the host, compromising the entire ObjectScale environment.

Dell ObjectScale products running any version earlier than 4.3.0.1 are affected. No specific sub‑versions are listed beyond the general "prior to 4.3.0.1" scope.

The CVSS score of 7.8 indicates a high severity risk. EPSS data is not available, so current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local, low‑privileged user—such as a compromised service account or a user with filesystem permissions—who can provide malicious command inputs. Once the command injection is successful, the attacker can gain elevated privileges on the affected host and potentially move laterally within the ObjectScale deployment.