CVE-2026-71171
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
Risk Assessment
The risk includes the possibility of remote code execution by a privileged attacker, which could lead to full system and data compromise.
Recommendation
Upgrade Dell Cloud Disaster Recovery to the latest patched version and restrict REST API access to trusted users only.
Other vulnerabilities in Dell Cloud Disaster Recovery
See all- CVE-2026-70419Critical
Dell Cloud Disaster Recovery versions 20.2 and prior contain an OS Command Injection vulnerability. A high privileged attacker with remote access could exploit this to execute commands.
- CVE-2026-71172Medium
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
- CVE-2025-43943Medium
Dell Cloud Disaster Recovery, versions prior to 19.20, contains an OS Command Injection vulnerability due to improper neutralization of special elements used in OS commands. A highly privileged attacker with local access could exploit this vulnerability to execute arbitrary commands with root privileges.
Original NVD description (English source)
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS