OS command injection in Dell PowerStore
Priority LOW 31CWE-78Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.
Summary
Dell EMC PowerStore, contains an OS command injection Vulnerability. A locally authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the PowerStore underlying OS, with the privileges of the vulnerable application. Exploitation may lead to an elevation of privilege.
Why it matters now
EPSS 0.008 56th percentileScored 2026-11-07
Fix Fixed PowerStore (Dell): X and T models
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | PowerStore | before X and T models | X and T models | Patch available | CNA |
- PowerStore VendorDell Affected before X and T models Fixed in X and T models Patch available CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dell:emc_powerstore_500t_firmware:*:*:*:*:*:*:*:* | before 3.0.0.0-1732745 | Vulnerable | Dell |
| cpe:2.3:h:dell:emc_powerstore_500t:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:emc_powerstore_1200t_firmware:*:*:*:*:*:*:*:* | before 3.0.0.0-1732745 | Vulnerable | Dell |
| cpe:2.3:h:dell:emc_powerstore_1200t:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:emc_powerstore_3200t_firmware:*:*:*:*:*:*:*:* | before 3.0.0.0-1732745 | Vulnerable | Dell |
| cpe:2.3:h:dell:emc_powerstore_3200t:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:emc_powerstore_5200t_firmware:*:*:*:*:*:*:*:* | before 3.0.0.0-1732745 | Vulnerable | Dell |
| cpe:2.3:h:dell:emc_powerstore_5200t:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:emc_powerstore_9200t_firmware:*:*:*:*:*:*:*:* | before 3.0.0.0-1732745 | Vulnerable | Dell |
| cpe:2.3:h:dell:emc_powerstore_9200t:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
- cpe:2.3:o:dell:emc_powerstore_500t_firmware:*:*:*:*:*:*:*:* Versions before 3.0.0.0-1732745 Vulnerable ·Dell
- cpe:2.3:h:dell:emc_powerstore_500t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:emc_powerstore_1200t_firmware:*:*:*:*:*:*:*:* Versions before 3.0.0.0-1732745 Vulnerable ·Dell
- cpe:2.3:h:dell:emc_powerstore_1200t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:emc_powerstore_3200t_firmware:*:*:*:*:*:*:*:* Versions before 3.0.0.0-1732745 Vulnerable ·Dell
- cpe:2.3:h:dell:emc_powerstore_3200t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:emc_powerstore_5200t_firmware:*:*:*:*:*:*:*:* Versions before 3.0.0.0-1732745 Vulnerable ·Dell
- cpe:2.3:h:dell:emc_powerstore_5200t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:emc_powerstore_9200t_firmware:*:*:*:*:*:*:*:* Versions before 3.0.0.0-1732745 Vulnerable ·Dell
- cpe:2.3:h:dell:emc_powerstore_9200t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Remediation
- Fix · CNA PowerStore (Dell) Fixed in X and T models
Timeline
- 2026-10-02 Threatist record created from CVE-2022-22555
- 2026-10-03 Alias added: GHSA-hr58-gmfj-355v
References
More Dell Emc Powerstore 1200t Firmware vulnerabilities
- TI-2022-13272 Missing brute-force protection in Dell PowerStore CVSS 3.1CRITICAL 9.8
- TI-2022-14928 OS command injection in Dell PowerStore CVSS 3.1HIGH 7.8
Sources
- CVE-2022-22555 · CVE Program
- CVE-2022-22555 · NVD
- FIRST EPSS
- GHSA-hr58-gmfj-355v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences