{"id":"CVE-2026-116413","kind":"vulnerability","aliases":["CVE-2026-116413"],"related":[],"title":"Dell PowerStore: broken cryptography lets a low-privileged user impersonate others","description":"Dell PowerStore contains a use-of-broken-cryptography vulnerability. A low-privileged attacker could exploit it to impersonate another identity, potentially leading to unauthorized access.","summary":"Dell PowerStore storage appliances use a broken cryptographic function. A low-privileged attacker could exploit it to impersonate another identity and potentially gain unauthorized access.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PowerStoreT OS","fixed":["5.1.0.0-2798105"],"affected":">= 5.1.0.0, < 5.1.0.0-2798105","ecosystem":"vendor"}],"ecosystems":[],"tags":["dell-powerstore","infrastructure","on-prem","powerstore","self-hosted","storage"],"not_affected_if":["patched-5.1.0.0-2798105"],"how_to_check":"In PowerStore Manager (Settings > Support/Cluster) or the CLI, read the PowerStoreT OS version. Exposed if it is 5.1.x earlier than 5.1.0.0-2798105. Dell's page lists no workaround.","fix":"Upgrade PowerStoreT OS to 5.1.0.0-2798105 or later (Dell DSA-2026-479).","status":"open","published_at":"2026-11-13T14:17:48+00:00","first_seen_at":"2026-11-13T15:19:48+00:00","triaged_at":"2026-11-13T15:21:23+00:00","updated_at":"2026-11-13T15:22:15+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-13T15:21:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Dell PowerStore: broken cryptography lets a low-privileged user impersonate others","impact":"high","summary":"Dell PowerStore storage appliances use a broken cryptographic function. A low-privileged attacker could exploit it to impersonate another identity and potentially gain unauthorized access.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["dell-powerstore","storage"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker impersonates another identity and gains unauthorized access","analyst_note":"Check the Dell security advisory for affected PowerStore versions, the fixed release, and the affected component; the NVD entry alone does not say.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Dell PowerStore storage appliances. The sources do not say which PowerStore versions or configurations are affected, or which component uses the broken cryptography.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000658,"input_tokens":4506,"output_tokens":414,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Dell security advisory for affected PowerStore versions, the fixed release, and the affected component; the NVD entry alone does not say.","search":"'-116413':15A,18A '-2026':14A,17A 'access':58B,85C 'anoth':52B,79C 'applianc':36B 'attack':46B,73C 'broken':3A,39B,66C 'contain':61C 'could':47B,74C 'cryptograph':40B 'cryptographi':4A,67C 'cve':13A,16A 'dell':1A,22B,33B,59C 'dell-powerstor':21B 'exploit':48B,75C 'function':41B 'gain':56B 'host':31B 'ident':53B,80C 'imperson':11A,51B,78C 'infrastructur':24B 'lead':82C 'let':5A 'low':8A,44B,71C 'low-privileg':7A,43B,70C 'on-prem':25B 'os':20A 'other':12A 'potenti':55B,81C 'powerstor':2A,23B,28B,34B,60C 'powerstoret':19A 'prem':27B 'privileg':9A,45B,72C 'self':30B 'self-host':29B 'storag':32B,35B 'unauthor':57B,84C 'use':37B,64C 'use-of-broken-cryptographi':63C 'user':10A 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Teams running Dell PowerStore T appliances (500T, 1000T, 1200T, 1500, 3000T, 3200Q, 3200T, 5000T, 5200Q, 5200T, 5500, 7000T, 9000T, 9200T, 9500) on PowerStoreT OS 5.1.x before 5.1.0.0-2798105. A low-privileged authenticated user could exploit broken cryptography over the network to impersonate another identity. Those on 5.1.0.0-2798105 or later can skip it. Dell does not name the component.","tier":"B","verified":{"fix":{"at":"2026-11-13T15:22:15Z","by":"analyst","doc":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities","run_id":3885},"products":{"at":"2026-11-13T15:22:15Z","by":"analyst","doc":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities","run_id":3885},"who_affected":{"at":"2026-11-13T15:22:15Z","by":"analyst","doc":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities","run_id":3885}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["os","powerstoretos"],"ptokens":["os","powerstoret"],"labels":["dellpowerstore","high","infrastructure","onprem","powerstore","selfhosted","storage"],"campaign_type":null,"search_a":"'-116413':15A,18A '-2026':14A,17A 'broken':3A 'cryptographi':4A 'cve':13A,16A 'dell':1A 'imperson':11A 'let':5A 'low':8A 'low-privileg':7A 'os':20A 'other':12A 'powerstor':2A 'powerstoret':19A 'privileg':9A 'user':10A","search_b":"'access':58B 'anoth':52B 'applianc':36B 'attack':46B 'broken':39B 'could':47B 'cryptograph':40B 'dell':22B,33B 'dell-powerstor':21B 'exploit':48B 'function':41B 'gain':56B 'host':31B 'ident':53B 'imperson':51B 'infrastructur':24B 'low':44B 'low-privileg':43B 'on-prem':25B 'potenti':55B 'powerstor':23B,28B,34B 'prem':27B 'privileg':45B 'self':30B 'self-host':29B 'storag':32B,35B 'unauthor':57B 'use':37B","search_c":"'access':85C 'anoth':79C 'attack':73C 'broken':66C 'contain':61C 'could':74C 'cryptographi':67C 'dell':59C 'exploit':75C 'ident':80C 'imperson':78C 'lead':82C 'low':71C 'low-privileg':70C 'potenti':81C 'powerstor':60C 'privileg':72C 'unauthor':84C 'use':64C 'use-of-broken-cryptographi':63C 'vulner':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T14:17:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116413","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116413","severity":null,"published_at":"2026-11-13T14:17:48+00:00","modified_at":"2026-11-13T14:17:48+00:00","first_seen_at":"2026-11-13T15:19:48+00:00","fetched_at":"2026-11-13T15:19:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116413:3885","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities","severity":null,"published_at":"2026-11-13T15:22:15+00:00","modified_at":"2026-11-13T15:22:15+00:00","first_seen_at":"2026-11-13T15:22:15+00:00","fetched_at":"2026-11-13T15:22:15+00:00","note":"Dell DSA-2026-479 lists CVE-2026-116413 (CVSS 7.1, one of ~44 in this advisory); fix 5.1.0.0-2798105. Advisory does not state exploitation or workarounds; component not named. Affected range as Dell words it: 5.1.x prior to 5.1.0.0-2798105 (my range string approximates it).","cites":["https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"]}],"documents":[{"id":146567,"url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities","title":"DSA-2026-479: Dell PowerStore T Security Update for Multiple Vulnerabilities","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}