Dell PowerScale OneFS up to 9.5.0.8/9.7.0.0/9.7.0.2 unnecessary privileges

Summaryinfo

A vulnerability classified as problematic has been found in Dell PowerScale OneFS up to 9.5.0.8/9.7.0.0/9.7.0.2. This vulnerability affects unknown code. The manipulation leads to unnecessary privileges. This vulnerability is referenced as CVE-2024-32853. The attack can only be performed from a local environment. No exploit is available.

Detailsinfo

A vulnerability was found in Dell PowerScale OneFS up to 9.5.0.8/9.7.0.0/9.7.0.2 and classified as problematic. This issue affects some unknown processing. The manipulation with an unknown input leads to a unnecessary privileges vulnerability. Using CWE to declare the problem leads to CWE-250. The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. Impacted is integrity, and availability. The summary by CVE is:

Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.2 contain an execution with unnecessary privileges vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges.

The advisory is shared at dell.com. The identification of this vulnerability is CVE-2024-32853 since 04/19/2024. The exploitation is known to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/21/2026). MITRE ATT&CK project uses the attack technique T1068 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 277542 (Dell PowerScale OneFS 8.2.2 <= 9.5.0.8 / 9.6.0.0 <= 9.7.0.2 Escalation of Privileges (DSA-2024-255)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (277542). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Dell

Name

• PowerScale OneFS

Version

• 9.5.0.0
• 9.5.0.1
• 9.5.0.2
• 9.5.0.3
• 9.5.0.4
• 9.5.0.5
• 9.5.0.6
• 9.5.0.7
• 9.5.0.8
• 9.7.0
• 9.7.0.0
• 9.7.0.1
• 9.7.0.2

License

• commercial

Website

• Vendor: https://www.dell.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion