Dell Unisphere for PowerMax SQL Injection Vulnerability Allowing Command Execution

A SQL injection vulnerability has been identified in Dell Unisphere for PowerMax, specifically in version 10.2.0.x. This vulnerability arises from improper neutralization of special elements used in SQL commands, allowing low-privileged attackers with remote access to potentially exploit the issue and execute commands.

Impact

Exploitation of this vulnerability could lead to unauthorized command execution on the affected system.

Remediation

Users can upgrade to version 9.2.4.19 or later. For Unisphere for PowerMax Virtual Appliance, version 9.2.4.19 or later is recommended. For Unisphere 360, version 9.2.4.41 or later is advised. Dell PowerMax EEM users should contact customer support and request the DSA-2025-425 update.