Read the docs
TI-2020-04380 Aliases CVE-2020-5327GHSA-p5w7-5575-crv3

Deserialization of untrusted data in Dell Encryption Enterprise

Priority MEDIUM 48CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-502.

Summary

Dell Security Management Server versions prior to 10.2.10 contain a Java RMI Deserialization of Untrusted Data vulnerability. When the server is exposed to the internet and Windows Firewall is disabled, a remote unauthenticated attacker may exploit this vulnerability by sending a crafted RMI request to execute arbitrary code on the target host.

Why it matters now

EPSS 0.03716 89th percentileScored 2026-11-07
Fix Fixed Dell Encryption Enterprise (Dell): 10.2.10

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellDell Encryption Enterprisebefore 10.2.1010.2.10Patch availableCNA
  • Dell Encryption Enterprise VendorDell Affected before 10.2.10 Fixed in 10.2.10 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dell:security_management_server:*:*:*:*:*:*:*:*before 10.2.10VulnerableDell
  • cpe:2.3:a:dell:security_management_server:*:*:*:*:*:*:*:* Versions before 10.2.10 Vulnerable ·Dell

Remediation

  • Fix · CNA Dell Encryption Enterprise (Dell) Fixed in 10.2.10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-5327
  2. 2026-10-03 Alias added: GHSA-p5w7-5575-crv3

References

Patch 1

  • TI-2025-24915 Link following in Dell Encryption CVSS 3.1HIGH 7.8
  • TI-2023-15761 Improper access control in Dell Encryption CVSS 3.1HIGH 7.8
  • TI-2023-20397 Link following in Dell Encryption, Dell Endpoint Security Suite Enterprise, Dell Security… CVSS 3.1HIGH 7.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences