CVE-2019-3704

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-02-07 · updated 2026-06-17
Weakness: CWE-78

Description

VNX Control Station in Dell EMC VNX2 OE for File versions prior to 8.1.9.236 contains OS command injection vulnerability. Due to inadequate restriction configured in sudores, a local authenticated malicious user could potentially execute arbitrary OS commands as root by exploiting this vulnerability.

Affected products

Dell EMC VNX Control Station in Dell EMC VNX2 OE for File: before 8.1.9.217 — fixed in 8.1.9.217

How to fix

Upgrade to a fixed version: Dell EMC VNX Control Station in Dell EMC VNX2 OE for File 8.1.9.217. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/106954
https://seclists.org/fulldisclosure/2019/Feb/8
http://www.securityfocus.com/bid/106954
https://seclists.org/fulldisclosure/2019/Feb/8

Get alerted when CVE-2019-3704 or the next vulnerability affects your stack