CVE-2025-36588CWE-89

Dell Unisphere for PowerMax, version(s) 10.2.0.x, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')…

High · published January 22, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
51.4
In the wild
Unconfirmed
What it is

🚨 A well-placed SQL command is all it takes for a low-privileged attacker to potentially execute commands on your Dell Unisphere! ⚡ Think of it like a restaurant where a customer uses a secret menu to sneak in their own order instead of selecting from the provided options. If the staff doesn't check carefully, the rogue order could lead to some alarming surprises! This vulnerability could allow an attacker to gain unauthorized control, potentially leading to data breaches or even full system compromise. Imagine someone not just peeking into your recipes but cooking up a storm in your kitchen!

Put simply

Think of it like a restaurant where a customer uses a secret menu to sneak in their own order instead of selecting from the provided options. If the staff doesn't check carefully, the rogue order could lead to some alarming surprises! This SQL Injection vulnerability in Dell Unisphere for PowerMax versions 10.2.0.x allows an attacker with limited privileges to manipulate SQL commands, enabling command execution on the server.

What to do

This vulnerability could allow an attacker to gain unauthorized control, potentially leading to data breaches or even full system compromise. Imagine someone not just peeking into your recipes but cooking up a storm in your kitchen! Patch your Dell Unisphere to the latest version immediately to mitigate this vulnerability. Additionally, review access controls and implement strict input validation to prevent SQL injection attacks. You've got this! With these steps, you’ll be protecting your system like a pro! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00671 · 51.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-01-22T15:52Z
EPSS history
Timeline
  • 22 JAN 15:52Z
    Dell Unisphere for PowerMax, version(s) 10.2.0.x, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')…
    cvelistv5