Dell vulnerabilities
We track 854 vulnerabilities in Dell products across 60+ products. 853 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on November 13, 2026.
Latest Dell vulnerabilities
- 7.5 High severity
Dell BIOS contains an improper input validation vulnerability.
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- 7.8 High severity
Dell BIOS contains an improper input validation vulnerability.
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- 9.8 Critical severity
Secure Connect Gateway (SCG) Policy Manager: Use of Hard-coded Credentials
Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of the hard-coded sensitive information, could potentially exploit this vulnerability to login to the sys
- 9.8 Critical severity
Secure Connect Gateway (SCG) Policy Manager: Use of Hard-coded Credentials
Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of the hard-coded sensitive information, could potentially exploit this vulnerability to login to the sys
- 7.5 High severity
PowerScale OneFS: Allocation of Resources Without Limits or Throttling
Dell PowerScale OneFS, versions 8.2.0.x-9.4.0.x contain allocation of Resources Without Limits or Throttling vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service and performance issue on th
- 9.8 Critical severity
PowerStore: Improper Authentication
Dell PowerStore versions 2.1.0.x contain an Authentication bypass vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability under specific configuration. An attacker would gain unauthorized access upon successful exploit.
- 7.8 High severity
CPG BIOS: Improper Restriction of Operations within the Bounds of a Memory Buffer
Dell Client BIOS Versions prior to the remediated version contain an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- 7.8 High severity
CPG BIOS: Use of Uninitialized Resource
Dell BIOS contains a use of uninitialized variable vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- 7.1 High severity
GeoDrive: Improper Limitation of a Pathname to a Restricted Directory
Dell GeoDrive, Versions 1.0 - 2.2, contain a Path Traversal Vulnerability in the reporting function. A local, low privileged attacker could potentially exploit this vulnerability, to gain unauthorized delete access to the files stored on the server filesystem,
- 7.8 High severity
GeoDrive: Incorrect Default Permissions
Dell GeoDrive, versions prior to 2.2, contains Insecure File and Folder Permissions vulnerabilities. A low privilege attacker could potentially exploit this vulnerability, leading to the execution of arbitrary code in the SYSTEM security context. Dell recommen
- 7.8 High severity
GeoDrive: Uncontrolled Search Path Element
Dell GeoDrive, versions prior to 2.2, contains Multiple DLL Hijacking Vulnerabilities. A low privilege attacker could potentially exploit this vulnerability, leading to the execution of arbitrary code in the SYSTEM security context.
- 7.8 High severity
GeoDrive: Unquoted Search Path or Element
Dell GeoDrive, versions prior to 2.2, contains an Unquoted File Path vulnerability. A low privilege attacker could potentially exploit this vulnerability, leading to the execution of arbitrary code in the SYSTEM security context.
- 7.8 High severity
GeoDrive: Exposure of Sensitive Information to an Unauthorized Actor
Dell GeoDrive, versions 2.1 - 2.2, contains an information disclosure vulnerability in GUI. An authenticated non-admin user could potentially exploit this vulnerability and view sensitive information.
- 7.8 High severity
CPG BIOS: Out-of-bounds Write
Dell BIOS contains an Stack-Based Buffer Overflow vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- 7.8 High severity
CPG BIOS: Buffer Copy without Checking Size of Input
Dell Client BIOS contains a Buffer Overflow vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by manipulating an SMI to cause an arbitrary write during SMM.
- 7.8 High severity
Dell BIOS contains an improper input validation vulnerability.
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- 7.8 High severity
Dell BIOS contains an improper input validation vulnerability.
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- 7.8 High severity
Dell BIOS contains an improper input validation vulnerability.
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- 7.8 High severity
Dell BIOS contains an improper input validation vulnerability.
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- 9.8 Critical severity
XtremIO: Improper Restriction of Excessive Authentication Attempts
Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. A remote unauthenticated attacker can potentially exploit this vulnerability and gain access to an admin account.
- 8.2 High severity
Dell Hybrid Client (DHC): Improper Neutralization of Special Elements used in a Command
Dell Hybrid Client below 1.8 version contains a gedit vulnerability. A guest attacker could potentially exploit this vulnerability, allowing deletion of user and some system files and folders.
- 7.5 High severity
Dell Hybrid Client (DHC): Improper Restriction of Recursive Entity References in DTDs
Dell Hybrid Client below 1.8 version contains a Zip Bomb Vulnerability in UI. A guest privilege attacker could potentially exploit this vulnerability, leading to system files modification.
- 8.8 High severity
Dell Container Storage Modules: Improper Neutralization of Special Elements used in an OS Command
Dell Container Storage Modules 1.2 contains an OS Command Injection in goiscsi and gobrick libraries. A remote unauthenticated attacker could exploit this vulnerability leading to modification of intended OS command execution.
- 8.8 High severity
Dell Container Storage Modules: Improper Limitation of a Pathname to a Restricted Directory
Dell Container Storage Modules 1.2 contains an Improper Limitation of a Pathname to a Restricted Directory in goiscsi and gobrick libraries which could lead to OS command injection. A remote unauthenticated attacker could exploit this vulnerability leading to
- 8.8 High severity
Dell BIOS contains an improper input validation vulnerability.
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- 8.8 High severity
Dell BIOS contains an improper input validation vulnerability.
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- 7.5 High severity
Enterprise SONiC OS: Use of Hard-coded Credentials
Dell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to communication.
- 7.1 High severity
Dell Hybrid Client (DHC): Improper Limitation of a Pathname to a Restricted Directory
Dell Hybrid Client below 1.8 version contains a Zip Slip Vulnerability in UI. A guest privilege attacker could potentially exploit this vulnerability, leading to system files modification.
- 7.5 High severity
Dell Networking OS10: Out-of-bounds Write
Networking OS10, versions 10.5.1.x, 10.5.2.x, and 10.5.3.x contain a vulnerability that could allow an attacker to cause a system crash by running particular security scans.
- 7.8 High severity
CPG BIOS: Out-of-bounds Write
Dell BIOS versions contain a Stack-based Buffer Overflow vulnerability. A local authenticated malicious user could potentially exploit this vulnerability by sending excess data to a function in order to gain arbitrary code execution on the system.
- 7.8 High severity
CPG BIOS: Insecure Automated Optimizations
Dell BIOS versions contain an Insecure Automated Optimization vulnerability. A local authenticated malicious user could exploit this vulnerability by sending malicious input via SMI to obtain arbitrary code execution during SMM.
- 7.8 High severity
CPG BIOS: Out-of-bounds Write
Dell BIOS versions contain a stack-based buffer overflow vulnerability. A local attacker could exploit this vulnerability by sending malicious input via SMI to bypass security checks resulting in arbitrary code execution in SMM.
- 7.0 High severity
CPG BIOS: Time-of-check Time-of-use (TOCTOU) Race Condition
Dell BIOS contains a race condition vulnerability. A local attacker could exploit this vulnerability by sending malicious input via SMI in order to bypass security checks during SMM.
- 7.8 High severity
CPG BIOS: Improper Authentication
Dell BIOS versions contain an Improper Authentication vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls.
- 9.8 Critical severity
PowerScale OneFS: Insufficiently Protected Credentials
Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.3, contain an unprotected transport of credentials vulnerability. A malicious unprivileged network attacker could potentially exploit this vulnerability, leading t
- 7.5 High severity
PowerScale OneFS: Insertion of Sensitive Information into Log File
Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.20, 9.2.1.13, 9.3.0.6, and 9.4.0.3 , contain an insertion of sensitive information in log files vulnerability. A remote unprivileged attacker could potentially exploit this vulnerability, leading
- 8.2 High severity
CloudLink: Improper Authentication
Dell CloudLink 7.1.3 and all earlier versions contain an Authentication Bypass Using an Alternate Path or Channel Vulnerability. A high privileged local attacker may potentially exploit this vulnerability leading to authentication bypass and access the CloudLi
- 9.8 Critical severity
CloudLink: Improper Authentication
Dell EMC CloudLink 7.1.2 and all prior versions contain an Authentication Bypass Vulnerability. A remote attacker, with the knowledge of the active directory usernames, could potentially exploit this vulnerability to gain unauthorized access to the system.
- 9.1 Critical severity
Cyber Recovery: Improper Authentication
Dell PowerProtect Cyber Recovery versions before 19.11.0.2 contain an authentication bypass vulnerability. A remote unauthenticated attacker may potentially access and interact with the docker registry API leading to an authentication bypass. The attacker may
- 8.2 High severity
Edge Gateway 5200: Improper Neutralization of Special Elements used in an OS Command
Dell Edge Gateway 5200 (EGW) versions before 1.03.10 contain an operating system command injection vulnerability. A local malicious user may potentially exploit this vulnerability by using an SMI to bypass PMC mitigation and gain arbitrary code execution durin