Security readout for executives and security teams
Plain-English summary
This is a Dell PowerScale OneFS flaw that requires significant existing privileges. A malicious or compromised admin-level account could influence a search path and cause untrusted resources to run, creating an integrity risk. It is not described as remotely exploitable or publicly exploited in the provided sources.
Executive priority
Treat this as a moderate-priority administrative control issue. Prioritize remediation on internet-adjacent or high-value storage clusters, and verify privileged account hygiene. It is less urgent than remotely exploitable flaws, but storage integrity impact can be business-significant.
Technical view
CVE-2021-21562 is a CWE-426 untrusted search path issue in Dell EMC PowerScale OneFS. The CVSS vector is local, low complexity, high privileges, no user interaction, and high integrity impact. Affected versions listed are 8.1.2, 8.1.3, 9.0.0.x, and 9.1.0.x.
Likely exposure
Exposure is limited to organizations running the listed OneFS versions. The attacker must have ISI_PRIV_LOGIN_SSH or ISI_PRIV_LOGIN_CONSOLE and also ISI_PRIV_SYS_UPGRADE or ISI_PRIV_AUDIT, so the main concern is misuse of privileged accounts or post-compromise activity.
Exploitation context
The provided bundle does not show CISA KEV listing, public exploitation, exploit code, or remote attack evidence. Practical risk depends on whether privileged OneFS accounts are tightly controlled and monitored.
Researcher notes
The source evidence is concise. It identifies affected OneFS branches, privilege requirements, CWE-426, and CVSS 4.4. It does not provide technical internals, proof of exploitation, fixed versions, or detailed mitigations in the supplied bundle.
Mitigation direction
- Review Dell advisory 000188148 for the supported remediation path.
- Inventory PowerScale OneFS versions against 8.1.2, 8.1.3, 9.0.0.x, and 9.1.0.x.
- Limit SSH and console login privileges to necessary administrators only.
- Restrict upgrade and audit privileges using least privilege.
- Monitor privileged administrative activity until vendor remediation is confirmed.
Validation and detection
- Confirm deployed OneFS versions across all PowerScale clusters.
- Review accounts with ISI_PRIV_LOGIN_SSH or ISI_PRIV_LOGIN_CONSOLE.
- Review accounts with ISI_PRIV_SYS_UPGRADE or ISI_PRIV_AUDIT.
- Check Dell guidance for fixed versions or required configuration changes.
- Look for unusual privileged administrative activity involving path or upgrade workflows.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-426: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-21562 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N0.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.4MediumVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.dell.com/support/kbdoc/000188148CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Untrusted Search Path
Untrusted Search Path represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.