CVE-2020-26192 Privilege escalation in PowerScale OneFS

High 7.8 Published 9 Feb 2021 Updated 17 Sep 2024

Privileged non-admin users can escalate privileges to read data, modify software, or cause denial of service in Dell PowerScale OneFS.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-26192?

CVE-2020-26192 is a high-severity vulnerability in Dell Emc Powerscale Onefs, published on 9 Feb 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Dell EMC PowerScale OneFS versions 8.2.0 - 9.1.0 contain a privilege escalation vulnerability. A non-admin user with either ISI_PRIV_LOGIN_CONSOLE or ISI_PRIV_LOGIN_SSH may potentially exploit this vulnerability to read arbitrary data, tamper with system software or deny service to users. Note: no non-admin users or roles have these privileges by default.

Weakness: CWE-306

Which versions are affected by CVE-2020-26192?

It affects 1 product.

Products include Dell Emc Powerscale Onefs.

How do I fix CVE-2020-26192?

No fix has been published for CVE-2020-26192 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-26192 being exploited?

There is no known exploitation of CVE-2020-26192 in the wild and no public exploit code.

All Dell Emc Powerscale Onefs vulnerabilities

Sources

Also known as GHSA-m2cf-c967-wmcg.