OS command injection in Dell Integrated Data Protection Appliance
Priority LOW 38CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · Low · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs that could lead to manipulation of passwords and execution of malicious commands on ACM component.
Why it matters now
EPSS 0.01975 80th percentileScored 2026-11-07
Fix Fixed Integrated Data Protection Appliance (Dell): 2.0, 2.1, 2.2 +2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | Integrated Data Protection Appliance | before 2.0, 2.1, 2.2, 2.3, 2.4 | 2.0, 2.1, 2.2, 2.3, 2.4 | Patch available | CNA |
- Integrated Data Protection Appliance VendorDell Affected before 2.0, 2.1, 2.2, 2.3, 2.4 Fixed in 2.0, 2.1, 2.2, 2.3, 2.4 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | Dell |
| cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.1:*:*:*:*:*:*:* | 2.1 | Vulnerable | Dell |
| cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.2:*:*:*:*:*:*:* | 2.2 | Vulnerable | Dell |
| cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.3:*:*:*:*:*:*:* | 2.3 | Vulnerable | Dell |
| cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.4:*:*:*:*:*:*:* | 2.4 | Vulnerable | Dell |
- cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Dell
- cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Dell
- cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Dell
- cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.3:*:*:*:*:*:*:* Versions 2.3 Vulnerable ·Dell
- cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.4:*:*:*:*:*:*:* Versions 2.4 Vulnerable ·Dell
Remediation
- Fix · CNA Integrated Data Protection Appliance (Dell) Fixed in 2.0, 2.1, 2.2, 2.3, 2.4
Timeline
- 2026-10-02 Threatist record created from CVE-2020-5350
- 2026-10-03 Alias added: GHSA-hfm4-3rg3-394f
References
More Dell Emc Integrated Data Protection Appliance vulnerabilities
- TI-2018-01128 Missing authorization in Dell EMC Avamar, Integrated Data Protection Appliance CVSS 3.0CRITICAL 9.8
- TI-2018-07852 Dell EMC Avamar and Integrated Data Protection Appliance Remote Code Execution Vulnerability CVSS 3.0CRITICAL 9.8
- TI-2020-17716 Path traversal in Dell Avamar CVSS 3.1CRITICAL 10.0
- TI-2020-17714 SQL injection in Dell Avamar CVSS 3.1CRITICAL 10.0
- TI-2018-07848 Dell EMC Integrated Data Protection Appliance Undocumented Accounts Vulnerability CVSS 3.0HIGH 8.8
- TI-2020-17715 Path traversal in Dell Avamar CVSS 3.1HIGH 8.7
Sources
- CVE-2020-5350 · CVE Program
- CVE-2020-5350 · NVD
- FIRST EPSS
- GHSA-hfm4-3rg3-394f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences