CVE-2020-5328

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-03-06 · updated 2026-06-17
Weakness: CWE-306

Description

Dell EMC Isilon OneFS versions prior to 8.2.0 contain an unauthorized access vulnerability due to a lack of thorough authorization checks when SyncIQ is licensed, but encrypted syncs are not marked as required. When this happens, loss of control of the cluster can occur.

Affected products

Dell Isilon OneFS: before 8.2.0 — fixed in 8.2.0

How to fix

Upgrade to a fixed version: Dell Isilon OneFS 8.2.0. Check the vendor advisory for mitigations.

References

https://www.dell.com/support/security/en-us/details/541423/DSA-2020-039-Dell-EMC-Isilon-OneFS-Security-Update-for-a-SyncIQ-Vulnerability
https://www.dell.com/support/security/en-us/details/541423/DSA-2020-039-Dell-EMC-Isilon-OneFS-Security-Update-for-a-SyncIQ-Vulnerability

Get alerted when CVE-2020-5328 or the next vulnerability affects your stack