Description
Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
Published: 2026-08-26
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Protection mechanism bypass via improper certificate validation
Action: Apply Patch
AI Analysis

Impact

Dell PowerProtect One versions 20.1.0.0 and earlier contain a certificate validation flaw (CWE‑295). An unauthenticated remote attacker could present a forged or self‑signed certificate, causing the system to accept the connection and bypass its built‑in protection mechanisms. This could lead to unauthorized access to protected data or operational control depending on the stored assets and configuration.

Affected Systems

The vulnerability affects Dell PowerProtect One 20.1.0.0 and all previous releases. No other vendors or products were identified in the CNA data.

Risk and Exploitability

The CVSS base score is 5.9, indicating moderate severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Attackers would need remote network access and the ability to provide a certificate to the target. Given the CVSS rating, the risk is non‑critical but still significant, and the attack vector is remote with no authentication required.

Generated by OpenCVE AI on August 26, 2026 at 21:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the Dell PowerProtect One security update referenced in Dell Support article KB 000500902.
  • Upgrade all affected installations to a version newer than 20.1.0.0, such as 20.1.0.1 or later.
  • Reconfigure remote access to enforce strict certificate validation, accepting only certificates issued by trusted authorities and rejecting self‑signed or improperly chained certificates.

Generated by OpenCVE AI on August 26, 2026 at 21:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell powerprotect One
CPEs cpe:2.3:a:dell:powerprotect_one:*:*:*:*:*:*:*:*
Vendors & Products Dell
Dell powerprotect One

Thu, 27 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Title Improper Certificate Validation Allows Remote Bypass in Dell PowerProtect One

Wed, 26 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
Weaknesses CWE-295
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Dell Powerprotect One
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-08-27T14:42:11.386Z

Reserved: 2026-08-16T11:04:50.574Z

Link: CVE-2026-74774

cve-icon Vulnrichment

Updated: 2026-08-27T14:42:06.979Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-26T20:17:59.603

Modified: 2026-08-28T20:35:47.450

Link: CVE-2026-74774

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T14:23:56Z

Weaknesses
  • CWE-295

    Improper Certificate Validation