TI-2021-04633 Aliases CVE-2021-21548 GHSA-pcx5-cm5r-cf7f

Improper certificate validation in Dell Unisphere for PowerMax, Dell EMC Unisphere for…

LOW 34CWE-295Published 2023-03-17 · Updated 2025-02-26

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Spoofing
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

Dell EMC Unisphere for PowerMax versions before 9.1.0.27, Dell EMC Unisphere for PowerMax Virtual Appliance versions before 9.1.0.27, and PowerMax OS Release 5978 contain an improper certificate validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to carry out a man-in-the-middle attack by supplying a crafted certificate and intercepting the victim's traffic to view or modify a victim’s data in transit.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00292 21st percentileScored 2026-11-07

Fix Fixed Unisphere for PowerMax, Dell EMC Unisphere for PowerMax Virtual Appliance , PowerMax OS (Dell): 9.1.0.27

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dell	Unisphere for PowerMax, Dell EMC Unisphere for PowerMax Virtual Appliance , PowerMax OS	before 9.1.0.27; 5978	9.1.0.27	Patch available	CNA

Unisphere for PowerMax, Dell EMC Unisphere for PowerMax Virtual Appliance , PowerMax OS VendorDell Affected before 9.1.0.27; 5978 Fixed in 9.1.0.27 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:dell:emc_unisphere_for_powermax::::::::	before 9.1.0.27	Vulnerable	Dell
cpe:2.3:a:dell:emc_unisphere_for_powermax_virtual_appliance::::::::	before 9.1.0.27	Vulnerable	Dell
cpe:2.3:o:dell:powermax_os:5978:::::::*	5978	Vulnerable	Dell

cpe:2.3:a:dell:emc_unisphere_for_powermax:*:*:*:*:*:*:*:* Versions before 9.1.0.27 Vulnerable ·Dell
cpe:2.3:a:dell:emc_unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:* Versions before 9.1.0.27 Vulnerable ·Dell
cpe:2.3:o:dell:powermax_os:5978:*:*:*:*:*:*:* Versions 5978 Vulnerable ·Dell

Remediation

Fix · CNA Unisphere for PowerMax, Dell EMC Unisphere for PowerMax Virtual Appliance , PowerMax OS (Dell) Fixed in 9.1.0.27

Timeline

2026-10-02 Threatist record created from CVE-2021-21548
2026-10-03 Alias added: GHSA-pcx5-cm5r-cf7f

References

Advisory 1

https://www.dell.com/support/kbdoc/en-uk/000189606/dsa-2021-134-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-security-update-for-multiple-third-party-component-vulnerabilities

TI-2020-04418 Improper certificate validation in Dell Unisphere for PowerMax, Unisphere for PowerMax… CVSS 3.1HIGH 8.1
TI-2022-22192 Information disclosure in Dell Unisphere for PowerMax vApp CVSS 3.1MEDIUM 6.5
TI-2020-04397 Missing authorization in Dell Unisphere for PowerMax CVSS 3.1MEDIUM 6.4
TI-2019-13452 Cross-site scripting in Dell Unisphere for PowerMax CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences