CVE-2026-40636
Hard-Coded Credentials in Dell ECS and ObjectScale
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: Dell
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dell | ecs | From 3.8.1.0 (inc) to 3.8.1.7 (inc) |
| dell | objectscale | to 4.3.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-798 | The product contains hard-coded credentials, such as a password or cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0. It involves the use of hard-coded credentials, which means that fixed usernames and passwords are embedded in the software.
An attacker who has local access but is unauthenticated could exploit this vulnerability to gain access to the filesystem.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to an attacker gaining unauthorized filesystem access. This can result in full compromise of confidentiality, integrity, and availability of the affected system.
- Confidentiality: Attacker can access sensitive data.
- Integrity: Attacker can modify or delete files.
- Availability: Attacker can disrupt system operations.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves the use of hard-coded credentials in Dell ECS and Dell ObjectScale products, which can be exploited by an unauthenticated attacker with local access to gain filesystem access.
Such unauthorized access could lead to breaches of confidentiality, integrity, and availability of sensitive data, potentially resulting in non-compliance with data protection regulations such as GDPR and HIPAA.
Specifically, unauthorized filesystem access may expose personal or protected health information, violating requirements for data security and privacy mandated by these standards.