Dell Virtual Storage Integrator for VMware vSphere Client prior to version 10.11.1.0 contains an OS Command Injection flaw in the IAPI component. An unauthenticated attacker who can reach the component can execute arbitrary operating system commands with root privileges. This leads to full control over the VSI appliance and potentially the underlying host, compromising confidentiality, integrity, and availability of the entire deployment. The vulnerability is categorized as CWE‑78 – OS Command Injection.

Products affected are Dell Virtual Storage Integrator for VMware vSphere Client with versions earlier than 10.11.1.0. The specific vendor is Dell and the product name is Virtual Storage Integrator for VMware vSphere Client. Users of earlier builds must verify whether they are running a vulnerable version and plan for an upgrade.

Based on the description, it is inferred that the likely attack vector is a remote, unauthenticated connection to the IAPI endpoint. The CVSS score of 9.8 indicates critical severity. While the EPSS score is currently unavailable, the vulnerability's remote nature and lack of authentication requirements suggest a high likelihood of exploitation if exposed to untrusted networks. The problem is not listed in the CISA KEV catalog, but its impact warrants urgent attention. An attacker can initiate exploitation by sending crafted requests to the IAPI endpoint, forcing execution of arbitrary commands on the host system. The ease of exploitation combined with full privilege escalation makes this a top‑priority security issue.