CVE-2025-36589
HighSummary
Dell Unisphere for PowerMax, versions 9.2.4.x, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could exploit this, leading to unauthorized access to data and resources outside the intended control sphere.
Risk Assessment
The risk for the organization includes potential leakage of sensitive data and access to internal network resources, which could compromise confidentiality and integrity of systems managed by Unisphere.
Recommendation
It is recommended to immediately apply patches provided by Dell for version 9.2.4.x and restrict network access to the Unisphere system to trusted users only.
Other vulnerabilities in Dell Unisphere for PowerMax
See all- CVE-2026-54470Medium
A vulnerability in Dell Unisphere for PowerMax versions 10.3.0.5 and prior allows a low-privileged attacker to remotely exploit improper restriction of XML external entity references (XXE). This could lead to unauthorized access to the system.
- CVE-2026-54469High
Deserialization of untrusted data vulnerability in Dell Unisphere for PowerMax versions 10.3.0.5 and prior. A low-privileged attacker with remote access can exploit this to execute arbitrary commands with root privileges.
- CVE-2026-54468Medium
A path traversal vulnerability in Dell Unisphere for PowerMax versions 10.3.0.5 and prior allows a low-privileged attacker with remote access to read arbitrary files on the system.
Original NVD description (English source)
Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access to data and resources outside of the intended sphere of control.