CVE-2026-56688

{
  "id": "CVE-2026-56688",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-10T12:17:23.453",
  "lastModified": "2026-10-24T23:10:00.160",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability during OS Repository processing to achieve arbitrary command execution as root, potentially leading to full appliance compromise and lateral movement into managed infrastructure."
    },
    {
      "lang": "es",
      "value": "Dell PowerFlex Manager, versión anterior a 5.1.0.1, contiene una vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un comando del sistema operativo (’inyección de comandos del sistema operativo’). Un atacante con altos privilegios y acceso remoto podría potencialmente explotar esta vulnerabilidad durante el procesamiento del repositorio del sistema operativo para lograr la ejecución arbitraria de comandos como root, lo que podría llevar al compromiso total del dispositivo y al movimiento lateral hacia la infraestructura gestionada."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Dell",
          "product": "PowerFlex Manager",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "5.1.0.1 or later",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "4.5.5.2 or later",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-10T16:49:45.463721Z",
          "id": "CVE-2026-56688",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:dell:powerflex_manager:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.5.5",
              "versionEndExcluding": "4.5.5.2",
              "matchCriteriaId": "9B1A1796-D5F8-46BD-AAE7-4C7ED2F49225"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:dell:powerflex_manager:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.1.0",
              "versionEndExcluding": "5.1.0.1",
              "matchCriteriaId": "B4E69DCB-28C5-41A7-B886-FF67BA35079F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}