Description
Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
Published: 2026-10-14
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

Dell PowerScale InsightIQ contains a SQL injection flaw, identified as CWE-89 due to improper neutralization of special elements in an SQL command. A malicious actor with local, low‑privileged access can exploit the flaw, potentially causing the system to become unresponsive or crash, thereby denying legitimate users access to the platform.

Affected Systems

The vulnerability affects Dell PowerScale InsightIQ versions 5.2.0 through 6.3.0.

Risk and Exploitability

The CVSS score of 6.1 indicates a moderate severity. An EPSS score of < 1% reflects a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local; a low‑privileged adversary must already have local access to trigger the injection, which can result in service disruption rather than data exfiltration or code execution.

Generated by OpenCVE AI on October 15, 2026 at 22:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Dell Security Update for PowerScale InsightIQ covering versions 5.2.0 to 6.3.0 as released in the Dell advisory.
  • Restrict local system access to only necessary administrative accounts and enforce the principle of least privilege to limit potential attackers’ user rights.
  • Review and, if possible, reconfigure any application or web interface that constructs SQL queries to ensure proper parameterization or use of safe query APIs to eliminate injection vectors.

Generated by OpenCVE AI on October 15, 2026 at 22:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell powerscale Insightiq
Vendors & Products Dell
Dell powerscale Insightiq

Thu, 15 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Title SQL Injection Leading to Denial of Service in Dell PowerScale InsightIQ

Wed, 14 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
Title SQL Injection Leading to Denial of Service in Dell PowerScale InsightIQ

Wed, 14 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Description Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'}

Subscriptions

Dell Powerscale Insightiq
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-10-14T17:36:53.909Z

Reserved: 2026-09-21T10:04:43.315Z

Link: CVE-2026-94348

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T14:17:48.423

Modified: 2026-10-14T18:19:36.187

Link: CVE-2026-94348

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T21:45:06Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')