A critical OS command injection vulnerability in Dell PowerStore allows local authenticated users to escalate privileges to root, posing a severe risk of full system compromise.

The appliance suffers from an OS command injection flaw (CWE-78) due to improper input sanitization. An attacker who has already obtained limited authenticated access to the system can leverage this vulnerability to execute arbitrary commands with administrative root privileges.

Successful exploitation results in a complete loss of confidentiality, integrity, and availability of the storage appliance. Given the CVSS score of 8.8, this vulnerability is classified as high severity, as it enables an attacker to bypass standard security controls, potentially leading to unauthorized data access, system disruption, or the installation of persistent backdoors within the storage environment.

Immediate Action: Update all affected Dell PowerStore appliances to version 4.1.0.6-2771237 or later as specified in the official vendor advisory.

Proactive Monitoring: Review system access logs for unusual command execution patterns, unexpected privilege escalation attempts, or unauthorized modifications to system configuration files.

Compensating Controls: Restrict administrative access to the management interface to authorized personnel only and enforce the principle of least privilege for all user accounts to minimize the potential attack surface.

Public Exploit Available: No (exploit_available: false).

This vulnerability represents a significant security risk for organizations utilizing Dell PowerStore infrastructure. Administrators must prioritize the application of the vendor-provided firmware update to prevent potential escalation attacks. Given the ability to achieve root-level execution, failure to patch leaves the storage environment susceptible to full compromise by any user with valid, even limited, credentials.