CVE-2026-82175 in PowerStore 500T
Summary
by MITRE • 11/13/2026
Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability. A high-privileged attacker could exploit this vulnerability to reach internal network services from the appliance.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2026
The identified vulnerability in Dell PowerStore represents a critical server-side request forgery flaw that allows an authenticated, high-privilege user to manipulate the application into making HTTP or HTTPS requests to unintended destinations. This type of weakness typically arises when a web application accepts untrusted input and uses it to construct URLs for internal service calls without adequate validation or sanitization mechanisms. In the context of Dell PowerStore, this architectural oversight enables an attacker who has obtained elevated credentials to redirect outbound network traffic from the storage appliance itself toward internal infrastructure components that are not directly exposed to external networks but may be accessible within the management or data planes.
From a technical perspective, the exploitation vector relies on the application's ability to process user-supplied parameters as part of backend requests. By injecting specific payloads into these input fields, an attacker can force the PowerStore appliance to initiate connections to internal IP addresses and ports that would otherwise be inaccessible from outside the system boundary. This effectively bypasses network-level access controls such as firewalls or segmentation rules because the traffic originates from a trusted source within the protected environment. The vulnerability is particularly severe due to the high privilege level required for exploitation, which implies that an attacker must first compromise administrative credentials through phishing, credential stuffing, or other initial access techniques before they can leverage this flaw for further lateral movement or data exfiltration.
The operational impact of this server-side request forgery extends beyond simple unauthorized access. An adversary could potentially probe internal network services running on the appliance's management interface, such as database servers, authentication backends, or monitoring agents. This capability facilitates reconnaissance activities where the attacker maps out the internal topology and identifies additional targets for exploitation. Furthermore, if sensitive data is stored in backend systems accessible via these forged requests, there is a significant risk of unauthorized data retrieval or modification. The ability to interact with internal services also opens avenues for denial-of-service attacks against critical infrastructure components by flooding them with maliciously crafted requests originating from the compromised storage appliance.
This vulnerability aligns closely with Common Weakness Enumeration identifier CWE-918, which defines server-side request forgery as a flaw where an attacker uses a vulnerable application to make requests on their behalf. Additionally, in terms of tactical mapping within the MITRE ATT&CK framework, this behavior corresponds to techniques involving internal network discovery and potentially data exfiltration via covert channels or direct service interaction. The exploitation path underscores the importance of strict input validation and output encoding practices when handling URLs or hostnames provided by users.
To mitigate this risk, immediate remediation should involve applying the vendor-provided software updates that address the underlying code flaw responsible for insufficient URL validation. Administrators must ensure that all Dell PowerStore systems are patched to the latest recommended version as specified in security advisories. Beyond patching, defense-in-depth strategies such as implementing strict network segmentation between management and data planes can limit the blast radius of a compromised appliance. Additionally, deploying web application firewalls with rules designed to detect SSRF patterns may provide an additional layer of protection by blocking outbound requests that attempt to access internal IP ranges or non-standard ports not explicitly required for normal operation. Regular auditing of administrative account usage and enforcing multi-factor authentication can also reduce the likelihood of initial credential compromise that precedes this exploitation chain.