DSA-2026-353: Security Update for Cloud Disaster Recovery Vulnerabilities
Summary: Cloud Disaster Recovery remediation is available for multiple security vulnerabilities that could be exploited by malicious users to compromise the affected system.
This article applies to
This article does not apply to
This article is not tied to any specific product.
Not all product versions are identified in this article.
Impact
Critical
Additional Details
This Security Advisory applies to Cloud Disaster Recovery versions 20.2 and previous.
Details
|
Proprietary Code CVEs |
Description |
CVSS Base Score |
CVSS Vector String |
|
|
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution. |
9.1 |
|
|
CVE-2026-71171 |
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. |
7.2 |
|
|
CVE-2026-68865 |
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain Remote Code Execution vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. |
7.2 |
|
|
CVE-2026-71173 |
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Limitation of a Pathname to a Restricted Directory vulnerability. A path traversal vulnerability exists in the application due to improper validation and sanitization of user-supplied file paths. |
6.5 |
|
|
CVE-2026-71172 |
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery. |
4.3 |
|
Proprietary Code CVEs |
Description |
CVSS Base Score |
CVSS Vector String |
|
|
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution. |
9.1 |
|
|
CVE-2026-71171 |
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. |
7.2 |
|
|
CVE-2026-68865 |
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain Remote Code Execution vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. |
7.2 |
|
|
CVE-2026-71173 |
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Limitation of a Pathname to a Restricted Directory vulnerability. A path traversal vulnerability exists in the application due to improper validation and sanitization of user-supplied file paths. |
6.5 |
|
|
CVE-2026-71172 |
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery. |
4.3 |
Affected Products & Remediation
|
CVEs Addressed |
Product |
Software/Firmware |
Affected Versions |
Remediated Versions |
Link |
|
CVE-2026-70419, CVE-2026-71171, CVE-2026-68865, CVE-2026-71172, CVE-2026-71173 |
Dell Cloud Disaster Recovery |
Software |
Versions CDR 20.2 and prior |
Version CDR 20.3 |
|
CVEs Addressed |
Product |
Software/Firmware |
Affected Versions |
Remediated Versions |
Link |
|
CVE-2026-70419, CVE-2026-71171, CVE-2026-68865, CVE-2026-71172, CVE-2026-71173 |
Dell Cloud Disaster Recovery |
Software |
Versions CDR 20.2 and prior |
Version CDR 20.3 |
Revision History
|
Revision |
Date |
Description |
|
1.0 |
2026-08-24 |
Initial Release |
Acknowledgements
-
Dell would like to thank moonv for reporting this issue: CVE-2026-71172, CVE-2026-68865, CVE-2026-71173
-
Dell would like to thank Ahmed Y. Elmogy for reporting this issue: CVE-2026-70419
-
Dell would like to thank WinD39 for reporting this issue: CVE-2026-71171
Related Information
Legal Disclaimer
Affected Products
Cloud Disaster RecoveryArticle Properties
Article Number: 000500898
Article Type: Dell Security Advisory
Last Modified: 24 Aug 2026
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.