Read the docs
TI-2022-10111 Aliases CVE-2022-26867GHSA-w9qh-pvx2-rhmh

CSV injection in Dell PowerStore

Priority LOW 36CWE-1236Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file. The data is taken as is, without any validation or sanitization. It allows a malicious, authenticated user to inject payloads that might get interpreted as formulas by the corresponding spreadsheet application that is being used to open the CSV/XLSX file.

Why it matters now

EPSS 0.00608 49th percentileScored 2026-11-07
Fix Fixed PowerStore (Dell): PowerStore SW v2.1.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellPowerStorebefore PowerStore SW v2.1.1.0PowerStore SW v2.1.1.0Patch availableCNA
  • PowerStore VendorDell Affected before PowerStore SW v2.1.1.0 Fixed in PowerStore SW v2.1.1.0 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:dell:powerstoreos:*:*:*:*:*:*:*:*before 2.1.1.0VulnerableDell
cpe:2.3:h:dell:powerstore_t:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:h:dell:powerstore_x:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
  • cpe:2.3:o:dell:powerstoreos:*:*:*:*:*:*:*:* Versions before 2.1.1.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:powerstore_t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:h:dell:powerstore_x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell

Remediation

  • Fix · CNA PowerStore (Dell) Fixed in PowerStore SW v2.1.1.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Dell PowerStore PowerStore SW v2.1.1.0

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2022-10112 OS command injection in Dell PowerStorePriority LOW 34
    • TI-2022-10110 Cross-site scripting in Dell PowerStorePriority LOW 25
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-26867
  2. 2026-10-03 Alias added: GHSA-w9qh-pvx2-rhmh

References

Advisory 1

  • TI-2026-42160 Missing authentication in Dell PowerStore 500T CVSS 3.1CRITICAL 9.8
  • TI-2022-10113 Information disclosure in Dell PowerStore CVSS 3.1CRITICAL 9.8
  • TI-2026-55184 Missing authentication in Dell PowerStore 500T CVSS 3.1CRITICAL 10.0
  • TI-2022-10114 Authentication bypass in Dell PowerStore CVSS 3.1CRITICAL 9.8
  • TI-2026-55183 Protection mechanism failure in Dell PowerStore 500T CVSS 3.1HIGH 8.8
  • TI-2026-55181 Protection mechanism failure in Dell PowerStore 500T CVSS 3.1HIGH 8.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences