LiveActive security incident?Get immediate response
CVE Record

CVE-2021-21599: Dell EMC PowerScale OneFS versions 8.2.x - 9.2.1.x contain an OS command injection vulnerability.

Dell EMC PowerScale OneFS versions 8.2.x - 9.2.1.x contain an OS command injection vulnerability. This may allow a user with ISI_PRIV_LOGIN_SSH or ISI_PRIV_LOGIN_CONSOLE to escalate privileges and escape the compliance guarantees. This only impacts Smartlock WORM compliance mode clusters as a critical vulnerability and Dell recommends to update/upgrade at the earliest opportunity.

MediumCVSS 6Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This flaw affects Dell EMC PowerScale OneFS 8.2.x through 9.2.1.x. A user who already has SSH or console login privileges could run operating system commands in a way that escalates privileges and undermines SmartLock WORM compliance guarantees. It is most urgent for compliance-mode storage clusters.

Executive priority

Treat this as urgent where PowerScale stores regulated or immutable records under SmartLock WORM compliance mode. For non-compliance clusters, prioritize based on privileged-user exposure and upgrade windows.

Technical view

CVE-2021-21599 is an OS command injection vulnerability in Dell EMC PowerScale OneFS. The CVSS vector indicates local access, low attack complexity, high privileges required, no user interaction, and high integrity and availability impact. Dell specifically treats SmartLock WORM compliance mode clusters as critically affected.

Likely exposure

Exposure is limited to Dell EMC PowerScale OneFS 8.2.x through 9.2.1.x, especially clusters using SmartLock WORM compliance mode. The attacker must already hold ISI_PRIV_LOGIN_SSH or ISI_PRIV_LOGIN_CONSOLE privileges.

Exploitation context

The provided sources do not show known active exploitation, and the CVE is not listed as KEV in the supplied bundle. Risk is insider, compromised administrator, or delegated operator misuse rather than unauthenticated internet exploitation.

Researcher notes

The available evidence names the affected version range and required privileges but does not provide CWE details, exact vulnerable component, exploit mechanics, or fixed version information in the bundle. Avoid assuming remote reachability or public exploitation.

Mitigation direction

  • Identify PowerScale OneFS clusters running 8.2.x through 9.2.1.x.
  • Prioritize SmartLock WORM compliance mode clusters for update or upgrade.
  • Follow Dell advisory guidance for the supported fixed upgrade path.
  • Review and reduce ISI_PRIV_LOGIN_SSH and ISI_PRIV_LOGIN_CONSOLE assignments.
  • Increase monitoring of privileged SSH and console activity until remediated.

Validation and detection

  • Confirm each cluster's OneFS version and SmartLock WORM compliance mode status.
  • Review privilege assignments for ISI_PRIV_LOGIN_SSH and ISI_PRIV_LOGIN_CONSOLE.
  • Check Dell advisory KB 000190408 for applicable update guidance.
  • Verify remediation by confirming the cluster is no longer on an affected version.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-21599 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H0.85.2Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6Medium
CVSS 3.1 vector shape for CVE-2021-21599Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
DellPowerScale OneFS8.2.x - 9.2.1.xListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.