Deserialization of untrusted data in Dell Avamar Virtual Edition
Priority MEDIUM 49CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.
Summary
Deserialization of Untrusted Data Vulnerability Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2, 19.1 and 19.2 and Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 and 2.4.1 contain a Deserialization of Untrusted Data Vulnerability. A remote unauthenticated attacker could exploit this vulnerability to send a serialized payload that would execute code on the system.
Why it matters now
EPSS 0.04254 91st percentileScored 2026-11-07
Fix Fixed Avamar Virtual Edition (Dell): Avamar 7.5 Virtual Edition for VMware vSphere only
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | Avamar Virtual Edition | before Avamar 7.5 Virtual Edition for VMware vSphere only | Avamar 7.5 Virtual Edition for VMware vSphere only | Patch available | CNA |
- Avamar Virtual Edition VendorDell Affected before Avamar 7.5 Virtual Edition for VMware vSphere only Fixed in Avamar 7.5 Virtual Edition for VMware vSphere only Patch available CNA
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dell:emc_avamar_server:7.4.1:*:*:*:*:*:*:* | 7.4.1 | Vulnerable | Dell |
| cpe:2.3:a:dell:emc_avamar_server:7.5.0:*:*:*:*:*:*:* | 7.5.0 | Vulnerable | Dell |
| cpe:2.3:a:dell:emc_avamar_server:7.5.1:*:*:*:*:*:*:* | 7.5.1 | Vulnerable | Dell |
| cpe:2.3:a:dell:emc_avamar_server:18.1:*:*:*:*:*:*:* | 18.1 | Vulnerable | Dell |
| cpe:2.3:a:dell:emc_avamar_server:18.2:*:*:*:*:*:*:* | 18.2 | Vulnerable | Dell |
| cpe:2.3:a:dell:emc_avamar_server:19.1:*:*:*:*:*:*:* | 19.1 | Vulnerable | Dell |
| cpe:2.3:a:dell:emc_avamar_server:19.2:*:*:*:*:*:*:* | 19.2 | Vulnerable | Dell |
| cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | Dell |
| cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.1:*:*:*:*:*:*:* | 2.1 | Vulnerable | Dell |
| cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.2:*:*:*:*:*:*:* | 2.2 | Vulnerable | Dell |
- cpe:2.3:a:dell:emc_avamar_server:7.4.1:*:*:*:*:*:*:* Versions 7.4.1 Vulnerable ·Dell
- cpe:2.3:a:dell:emc_avamar_server:7.5.0:*:*:*:*:*:*:* Versions 7.5.0 Vulnerable ·Dell
- cpe:2.3:a:dell:emc_avamar_server:7.5.1:*:*:*:*:*:*:* Versions 7.5.1 Vulnerable ·Dell
- cpe:2.3:a:dell:emc_avamar_server:18.1:*:*:*:*:*:*:* Versions 18.1 Vulnerable ·Dell
- cpe:2.3:a:dell:emc_avamar_server:18.2:*:*:*:*:*:*:* Versions 18.2 Vulnerable ·Dell
- cpe:2.3:a:dell:emc_avamar_server:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Dell
- cpe:2.3:a:dell:emc_avamar_server:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Dell
- cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Dell
- cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Dell
- cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Dell
Show 3 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.3:*:*:*:*:*:*:* | 2.3 | Vulnerable | Dell |
| cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.4:*:*:*:*:*:*:* | 2.4 | Vulnerable | Dell |
| cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.4.1:*:*:*:*:*:*:* | 2.4.1 | Vulnerable | Dell |
- cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.3:*:*:*:*:*:*:* Versions 2.3 Vulnerable ·Dell
- cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.4:*:*:*:*:*:*:* Versions 2.4 Vulnerable ·Dell
- cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.4.1:*:*:*:*:*:*:* Versions 2.4.1 Vulnerable ·Dell
Remediation
- Fix · CNA Avamar Virtual Edition (Dell) Fixed in Avamar 7.5 Virtual Edition for VMware vSphere only
Timeline
- 2026-10-02 Threatist record created from CVE-2020-5341
- 2026-10-03 Alias added: GHSA-wqh9-gr2m-8m6v
References
More Dell Emc Avamar Server vulnerabilities
- TI-2020-17716 Path traversal in Dell Avamar CVSS 3.1CRITICAL 10.0
- TI-2020-17714 SQL injection in Dell Avamar CVSS 3.1CRITICAL 10.0
- TI-2020-17715 Path traversal in Dell Avamar CVSS 3.1HIGH 8.7
- TI-2019-02780 Incorrect permission assignment in Dell Avamar CVSS 3.1HIGH 8.1
- TI-2019-02769 XML external entity injection in Dell Avamar CVSS 3.1HIGH 8.2
- TI-2021-04602 Improper authorization in Dell Avamar CVSS 3.1HIGH 8.1
Sources
- CVE-2020-5341 · CVE Program
- CVE-2020-5341 · NVD
- FIRST EPSS
- GHSA-wqh9-gr2m-8m6v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences