Dell Unisphere for PowerMax vApp Path Traversal Vulnerability (CVE-2026-101217)

Executive Summary

A vulnerability in Dell Unisphere for PowerMax vApp, versions 9.2.4.x, allows a low-privileged attacker with remote access to potentially exploit an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, leading to information disclosure. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. Affected systems should update to version 9.2.4.23 or later.

Technical Analysis

The vulnerability is classified as an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, which is a type of vulnerability that allows an attacker to access files or directories outside of the intended directory. The attack vector is network-based, and the vulnerability can be triggered by a low-privileged attacker with remote access. The root cause of the vulnerability is the improper limitation of a pathname to a restricted directory.

How It Gets Exploited

An attacker with low privileges and remote access could potentially exploit this vulnerability by sending a crafted request to the affected system, allowing them to traverse the directory structure and access files or directories outside of the intended directory. For example, an attacker might send a request with a malicious pathname that includes ../ characters, which could allow them to access files or directories outside of the intended directory. The attacker could potentially gain access to sensitive information, such as configuration files or sensitive data.

Impact Assessment

The vulnerability affects Dell Unisphere for PowerMax vApp, versions 9.2.4.x. The CVSS score for this vulnerability is 6.5, indicating a medium severity level. The vulnerability has a high impact on confidentiality, but no impact on integrity or availability. The blast radius of this vulnerability is relatively low, as it requires a low-privileged attacker with remote access to exploit.

Recommended Actions

To mitigate this vulnerability, affected systems should update to version 9.2.4.23 or later. Additionally, administrators should consider implementing network segmentation and access controls to limit the attack surface. Detection guidance: Monitor system logs for suspicious activity, such as unusual file access requests or errors indicating path traversal attempts.

Sources

- National Vulnerability Database (NVD) - Dell Support