CVE-2026-27102

#!/bin/bash # PoC for CVE-2026-27102: Dell PowerScale OneFS Incorrect Privilege Assignment # Description: This script demonstrates checking for the vulnerability condition. # Note: Actual exploitation requires specific access to the target environment. echo "[*] Dell PowerScale OneFS - Privilege Escalation PoC Check" echo "[*] Targeting CVE-2026-27102" # Check if running as low privilege user (simulated context) if [ "$EUID" -eq 0 ]; then echo "[-] Run this as a low-privileged user to test escalation." exit 1 fi # Hypothetical vulnerable binary path (specific to OneFS) VULN_PATH="/usr/local/bin/isi_auth_helper" if [ -e "$VULN_PATH" ]; then echo "[+] Found potential vulnerable component: $VULN_PATH" # Check for writable permissions on a sensitive file (example) if [ -w "$VULN_PATH" ]; then echo "[!] VULNERABLE: Target file is writable by current user." # In a real exploit, one might inject code or modify configuration here. echo "[*] Attempting to exploit misconfiguration..." # touch /tmp/exploit_success # Placeholder for exploit action else echo "[-] Permissions seem correct on $VULN_PATH." fi else echo "[-] Component not found. System may be patched or version differs." fi

{"cve": {"id": "CVE-2026-27102", "sourceIdentifier": "[email protected]", "published": "2026-04-08T13:16:41.370", "lastModified": "2026-04-13T11:38:11.023", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.1, contains an incorrect privilege assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "baseScore": 6.6, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 4.7}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-266"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:dell:powerscale_onefs:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.5.0.0", "versionEndExcluding": "9.10.1.7", "matchCriteriaId": "0FC6B685-F7C8-4A13-8AFE-7C4C1D7D9B10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:dell:powerscale_onefs:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.11.0.0", "versionEndExcluding": "9.13.0.2", "matchCriteriaId": "4FC908F9-310C-4DB0-BAA3-812F5D1072DD"}]}]}], "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000449337/dsa-2026-125-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}