{"id":"CVE-2025-26330","state":"PUBLISHED","title":"Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.1, contains an incorrect authorization vulnerability. An unauthenticated attacker with local access could potentially exploit","description":"Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.1, contains an incorrect authorization vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability to access the cluster with previous privileges of a disabled user account.","publishedAt":"2025-04-10T02:10:11.578Z","updatedAt":"2026-02-26T18:28:27.723Z","severity":{"score":7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"dell"},"assigner":"dell","products":["Dell PowerScale OneFS"],"affected":[{"vendor":"Dell","product":"PowerScale OneFS","defaultStatus":"unaffected","versions":[{"version":"9.4.0.0","status":"affected","lessThanOrEqual":"9.10.0.1","versionType":"semver"},{"version":"9.7.0.0","status":"affected","lessThanOrEqual":"9.7.1.4","versionType":"semver"}]}],"references":["https://www.dell.com/support/kbdoc/en-us/000300860/dsa-2025-119-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities"],"weaknesses":["CWE-863"],"ingestedAt":"2026-10-29T20:08:47.682Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/26xxx/CVE-2025-26330.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-26330","state":"PUBLISHED","datePublished":"2025-04-10T02:10:11.578Z","dateUpdated":"2026-02-26T18:28:27.723Z","assignerShortName":"dell","assignerOrgId":"c550e75a-17ff-4988-97f0-544cde3820fe","dateReserved":"2025-02-07T06:04:04.738Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.1, contains an incorrect authorization vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability to access the cluster with previous privileges of a disabled user account."}],"affected":[{"vendor":"Dell","product":"PowerScale OneFS","defaultStatus":"unaffected","versions":[{"version":"9.4.0.0","status":"affected","lessThanOrEqual":"9.10.0.1","versionType":"semver"},{"version":"9.7.0.0","status":"affected","lessThanOrEqual":"9.7.1.4","versionType":"semver"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000300860/dsa-2025-119-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","description":"CWE-863: Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"dell","orgId":"c550e75a-17ff-4988-97f0-544cde3820fe","dateUpdated":"2025-04-10T02:10:11.578Z"},"datePublic":"2025-04-07T06:30:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-26330","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-04-11T03:55:27.314831Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-26T18:28:27.723Z"}}]}}}