Read the docs
TI-2021-04598 Aliases CVE-2021-21506GHSA-3pjr-v8w5-hm42

Improper input validation in Dell PowerScale OneFS

Priority MEDIUM 40CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

PowerScale OneFS 8.1.2,8.2.2 and 9.1.0 contains an improper input sanitization issue in its API handler. An un-authtenticated with ISI_PRIV_SYS_SUPPORT and ISI_PRIV_LOGIN_PAPI privileges could potentially exploit this vulnerability, leading to potential privileges escalation.

Why it matters now

EPSS 0.01076 65th percentileScored 2026-11-07
Fix Fixed PowerScale OneFS (Dell): 8.1.2, 8.2.2,9.1.0.x,EMPIRE (9.2.0), GOTHAM

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellPowerScale OneFSbefore 8.1.2, 8.2.2,9.1.0.x,EMPIRE (9.2.0), GOTHAM8.1.2, 8.2.2,9.1.0.x,EMPIRE (9.2.0), GOTHAMPatch availableCNA
  • PowerScale OneFS VendorDell Affected before 8.1.2, 8.2.2,9.1.0.x,EMPIRE (9.2.0), GOTHAM Fixed in 8.1.2, 8.2.2,9.1.0.x,EMPIRE (9.2.0), GOTHAM Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:dell:emc_powerscale_onefs:8.1.2:*:*:*:*:*:*:*8.1.2VulnerableDell
cpe:2.3:o:dell:emc_powerscale_onefs:8.2.2:*:*:*:*:*:*:*8.2.2VulnerableDell
cpe:2.3:o:dell:emc_powerscale_onefs:9.1.0:*:*:*:*:*:*:*9.1.0VulnerableDell
  • cpe:2.3:o:dell:emc_powerscale_onefs:8.1.2:*:*:*:*:*:*:* Versions 8.1.2 Vulnerable ·Dell
  • cpe:2.3:o:dell:emc_powerscale_onefs:8.2.2:*:*:*:*:*:*:* Versions 8.2.2 Vulnerable ·Dell
  • cpe:2.3:o:dell:emc_powerscale_onefs:9.1.0:*:*:*:*:*:*:* Versions 9.1.0 Vulnerable ·Dell

Remediation

  • Fix · CNA PowerScale OneFS (Dell) Fixed in 8.1.2, 8.2.2,9.1.0.x,EMPIRE (9.2.0), GOTHAM

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Dell PowerScale OneFS 8.1.2, 8.2.2,9.1.0.x,EMPIRE (9.2.0), GOTHAM

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2021-04596 OS command injection in Dell PowerScale OneFSPriority LOW 34
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21506
  2. 2026-10-03 Alias added: GHSA-3pjr-v8w5-hm42

References

Advisory 1

  • TI-2022-22190 Improper privilege management in Dell PowerScale OneFS CVSS 3.1CRITICAL 9.8
  • TI-2022-10097 Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random… CVSS 3.1CRITICAL 9.8
  • TI-2022-06835 Missing brute-force protection in Dell PowerScale OneFS CVSS 3.1CRITICAL 9.8
  • TI-2021-04595 Improper authentication in Dell PowerScale OneFS CVSS 3.1CRITICAL 9.8
  • TI-2022-22189 Improper certificate validation in Dell PowerScale OneFS CVSS 3.1CRITICAL 9.8
  • TI-2022-15270 Insufficiently protected credentials in Dell PowerScale OneFS CVSS 3.1CRITICAL 9.8
See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences