CVE-2026-70415 - Vulnerability Details

Description

Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in NFS/RPC. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command execution and denial of service.

Published: 2026-08-18

Score: 8.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Dell PowerStore SDNAS contains a buffer copy without checking the size of input in its NFS/RPC service. This flaw enables an unauthenticated attacker with remote access to overwrite memory, potentially resulting in command execution or service disruption. The weakness is a classic buffer overflow (CWE‑120). The impact includes loss of confidentiality, integrity, and availability of the affected PowerStore appliance.

Affected Systems

Dell PowerStore models 1000T, 1200T, 3000T, 3200Q, 3200T, 5000T, 500T, 5200Q, 5200T, 7000T, 9000T, 9200T are affected according to the vendor advisory. Exact firmware or software release information is not specified, so all current releases of these models are potentially vulnerable.

Risk and Exploitability

The vulnerability has a CVSS score of 8.1, indicating high severity. The EPSS score is < 1%, reflecting a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote over the network and requires no authentication. An attacker can trigger the buffer overwrite by sending a crafted NFS/RPC request, after which they may execute arbitrary code or crash the service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Dell

PowerStore 500T

unaffected

Version	Status	Constraints
`0`	affected	< 5.0.0.2-2761110 or later

Dell

PowerStore 1000T

unaffected

Version	Status	Constraints
`0`	affected	< 5.0.0.2-2761110 or later

Dell

PowerStore 1200T

unaffected

Version	Status	Constraints
`0`	affected	< 5.0.0.2-2761110 or later

Dell

PowerStore 3000T

unaffected

Version	Status	Constraints
`0`	affected	< 5.0.0.2-2761110 or later

Dell

PowerStore 3200Q

unaffected

Version	Status	Constraints
`0`	affected	< 5.0.0.2-2761110 or later

Dell

PowerStore 3200T

unaffected

Version	Status	Constraints
`0`	affected	< 5.0.0.2-2761110 or later

Dell

PowerStore 5000T

unaffected

Version	Status	Constraints
`0`	affected	< 5.0.0.2-2761110 or later

Dell

PowerStore 5200Q

unaffected

Version	Status	Constraints
`0`	affected	< 5.0.0.2-2761110 or later

Dell

PowerStore 5200T

unaffected

Version	Status	Constraints
`0`	affected	< 5.0.0.2-2761110 or later

Dell

PowerStore 7000T

unaffected

Version	Status	Constraints
`0`	affected	< 5.0.0.2-2761110 or later

Dell

PowerStore 9000T

unaffected

Version	Status	Constraints
`0`	affected	< 5.0.0.2-2761110 or later

Della

PowerStore 9200T

unaffected

Version	Status	Constraints
`0`	affected	< 5.0.0.2-2761110 or later

No data.

Vendor Product Confidence Versions

Dell

Powerstore 1000t

100%

Version	Status	Scheme	Platform
`[0,5.0.0.2-2761110)`	affected	generic	—

Dell

Powerstore 1200t

100%

Version	Status	Scheme	Platform
`[0,5.0.0.2-2761110)`	affected	generic	—

Dell

Powerstore 3000t

100%

Version	Status	Scheme	Platform
`[0,5.0.0.2-2761110)`	affected	generic	—

Dell

Powerstore 3200q

100%

Version	Status	Scheme	Platform
`[0,5.0.0.2-2761110)`	affected	generic	—

Dell

Powerstore 3200t

100%

Version	Status	Scheme	Platform
`[0,5.0.0.2-2761110)`	affected	generic	—

Dell

Powerstore 5000t

100%

Version	Status	Scheme	Platform
`[0,5.0.0.2-2761110)`	affected	generic	—

Dell

Powerstore 500t

100%

Version	Status	Scheme	Platform
`[0,5.0.0.2-2761110)`	affected	generic	—

Dell

Powerstore 5200q

100%

Version	Status	Scheme	Platform
`[0,5.0.0.2-2761110)`	affected	generic	—

Dell

Powerstore 5200t

100%

Version	Status	Scheme	Platform
`[0,5.0.0.2-2761110)`	affected	generic	—

Dell

Powerstore 7000t

100%

Version	Status	Scheme	Platform
`[0,5.0.0.2-2761110)`	affected	generic	—

Dell

Powerstore 9000t

100%

Version	Status	Scheme	Platform
`[0,5.0.0.2-2761110)`	affected	generic	—

Dell

Powerstore 9200t

98%

Version	Status	Scheme	Platform
`[0,5.0.0.2-2761110)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Download and apply the Dell PowerStore security update published on 2026‑330 as described in the Dell advisory
Restrict inbound NFS/RPC traffic to trusted IP ranges
Monitor for anomalous RPC activity

Generated by OpenCVE AI on August 31, 2026 at 07:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00704.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.dell.com/support/kbdoc/en-us/000497829/dsa-2026-330-dell-powerstore-t-security-update-for-multiple-vulnerabilities

History

Mon, 31 Aug 2026 07:45:00 +0000

Type	Values Removed	Values Added
Title	Remote Command Execution via Buffer Overflow in Dell PowerStore NFS/RPC Service

Mon, 31 Aug 2026 07:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 31 Aug 2026 06:45:00 +0000

Type	Values Removed	Values Added
Description	Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in the NFS/RPC. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution and Denial of service.	Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in NFS/RPC. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command execution and denial of service.

Tue, 18 Aug 2026 20:15:00 +0000

Type	Values Removed	Values Added
Title		Remote Command Execution via Buffer Overflow in Dell PowerStore NFS/RPC Service

Tue, 18 Aug 2026 19:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Dell Dell powerstore 1000t Dell powerstore 1200t Dell powerstore 3000t Dell powerstore 3200q Dell powerstore 3200t Dell powerstore 5000t Dell powerstore 500t Dell powerstore 5200q Dell powerstore 5200t Dell powerstore 7000t Dell powerstore 9000t Dell powerstore 9200t
Vendors & Products		Dell Dell powerstore 1000t Dell powerstore 1200t Dell powerstore 3000t Dell powerstore 3200q Dell powerstore 3200t Dell powerstore 5000t Dell powerstore 500t Dell powerstore 5200q Dell powerstore 5200t Dell powerstore 7000t Dell powerstore 9000t Dell powerstore 9200t

Tue, 18 Aug 2026 17:00:00 +0000

Type	Values Removed	Values Added
Description		Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in the NFS/RPC. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution and Denial of service.
Weaknesses		CWE-120
References		https://www.dell.com/support/kbdoc/en-us/000497829/dsa-2026-330-dell-powerstore-t-security-update-for-multiple-vulnerabilities
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Subscriptions

Dell Powerstore 1000t Powerstore 1200t Powerstore 3000t Powerstore 3200q Powerstore 3200t Powerstore 5000t Powerstore 500t Powerstore 5200q Powerstore 5200t Powerstore 7000t Powerstore 9000t Powerstore 9200t

MITRE

Status: PUBLISHED

Assigner: dell

Published: 2026-08-18T16:54:57.477Z

Updated: 2026-08-31T06:04:14.301Z

Reserved: 2026-08-04T11:16:10.499Z

Link: CVE-2026-70415

Vulnrichment

Updated: 2026-08-20T18:36:51.435Z

NVD

Status : Awaiting Analysis

Published: 2026-08-18T17:17:01.973

Modified: 2026-08-31T07:17:45.537

Link: CVE-2026-70415

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-31T07:30:18Z

Weaknesses

CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object