CVE-2021-36339

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-21 · updated 2026-06-17
Weakness: CWE-250

Description

The Dell EMC Virtual Appliances before 9.2.2.2 contain undocumented user accounts. A local malicious user may potentially exploit this vulnerability to get privileged access to the virtual appliance.

Affected products

Dell Powermax Os: 5978
Dell Solutions Enabler: before 9.1.0.18; from 9.2.0.0 before 9.2.3.0 — fixed in 9.1.0.18, 9.2.3.0
Dell Solutions Enabler Virtual Appliance: before 9.1.0.18; from 9.2.0.0 before 9.2.3.0 — fixed in 9.1.0.18, 9.2.3.0
Dell Unisphere 360: before 9.1.0.29; from 9.2.0.0 before 9.2.3.3 — fixed in 9.1.0.29, 9.2.3.3
Dell Unisphere for PowerMax: before 9.1.0.31; from 9.2.0.0 before 9.2.3.4 — fixed in 9.1.0.31, 9.2.3.4
Dell Unisphere for PowerMax Virtual Appliance: before 9.1.0.31; from 9.2.0.0 before 9.2.3.4 — fixed in 9.1.0.31, 9.2.3.4
Dell Vasa: before 9.1.0.723; from 9.2.0.0 before 9.2.3.0 — fixed in 9.1.0.723, 9.2.3.0

How to fix

Upgrade to a fixed version: Dell Solutions Enabler 9.1.0.18, 9.2.3.0; Dell Solutions Enabler Virtual Appliance 9.1.0.18, 9.2.3.0; Dell Unisphere 360 9.1.0.29, 9.2.3.3; Dell Unisphere for PowerMax 9.1.0.31, 9.2.3.4; Dell Unisphere for PowerMax Virtual Appliance 9.1.0.31, 9.2.3.4; Dell Vasa 9.1.0.723, 9.2.3.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-36339 or the next vulnerability affects your stack