CVE-2022-26868

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Dell EMC PowerStore versions 2.0.0.x, 2.0.1.x, and 2.1.0.x are vulnerable to a command injection flaw. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system takeover by an attacker.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jun 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-268699.8Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. A remote unauthenticated attacker could potential CVE-2022-26879.8A vulnerability, which was classified as critical, was found in SourceCodester Gym Management System. Affected is an unknown function. The m CVE-2022-268709.8Dell PowerStore versions 2.1.0.x contain an Authentication bypass vulnerability. A remote unauthenticated attacker could potentially exploit CVE-2022-268719.8An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary fil CVE-2022-268728.8AMI Megarac Password reset interception via API CVE-2022-268738.2A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to t CVE-2022-268745.4lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde CVE-2022-268776.5Asana Desktop before 1.6.0 allows remote attackers to exfiltrate local files if they can trick the Asana desktop app into loading a maliciou CVE-2022-268785.5drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.16.3 has a memory leak (socket buffers have memory allocated but not freed).CVE-2022-26889.8A vulnerability was found in SourceCodester Expense Management System. It has been rated as critical. This issue affects the function fetch_CVE-2022-268846.5Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.CVE-2022-268857.5When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher.