Read the docs
TI-2022-14136 Aliases CVE-2022-32498GHSA-g8x4-8c3g-88qx

Uncontrolled search path in Dell PowerStore

Priority LOW 33CWE-427Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.

Summary

Dell EMC PowerStore, Versions prior to v3.0.0.0 contain a DLL Hijacking vulnerability in PSTCLI. A local attacker can potentially exploit this vulnerability to execute arbitrary code, escalate privileges, and bypass software allow list solutions, leading to system takeover or IP exposure.

Why it matters now

EPSS 0.00186 8th percentileScored 2026-11-07
Fix Fixed PowerStore (Dell): v3.0.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellPowerStorebefore v3.0.0.0v3.0.0.0Patch availableCNA
  • PowerStore VendorDell Affected before v3.0.0.0 Fixed in v3.0.0.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dell:powerstore_command_line_interface:*:*:*:*:*:linux:*:*before 3.0.0.0-1732745VulnerableDell
  • cpe:2.3:a:dell:powerstore_command_line_interface:*:*:*:*:*:linux:*:* Versions before 3.0.0.0-1732745 Vulnerable ·Dell

Remediation

  • Fix · CNA PowerStore (Dell) Fixed in v3.0.0.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Dell PowerStore v3.0.0.0

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2022-13272 Missing brute-force protection in Dell PowerStorePriority MEDIUM 44
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-32498
  2. 2026-10-03 Alias added: GHSA-g8x4-8c3g-88qx

References

Patch 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences