Vulnerability · Published Jan 5, 2021 · Assigned by dell
CVE-2020-26181
High 7.0
In plain English
A high-severity privilege mismanagement in PowerScale OneFS from Dell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.3%top 82.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Dell EMC Isilon OneFS versions 8.1 and later and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability on a SmartLock Compliance mode cluster. The compadmin user connecting using ISI PRIV LOGIN SSH or ISI PRIV LOGIN CONSOLE can elevate privileges to the root user if they have ISI PRIV HARDENING privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Dell | PowerScale OneFS | unspecified – before 8.1.2, 8.2.2, 9.0+ |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H