Improper Input Validation in Dell PowerProtect Data Manager

Executive Summary

This vulnerability is an Improper Input Validation issue in the REST API of Dell PowerProtect Data Manager versions before 20.2.0.0. It allows a high privileged remote attacker to escalate privileges by exploiting insufficient input checks.

Useful 0 Not Useful 0

Detection Guidance

Detection of CVE-2026-40712 requires checking the version of Dell PowerProtect Data Manager. If the version is prior to 20.2.0.0, the system is vulnerable. Use commands like 'rpm -qa | grep powerprotect' on Linux or check installed programs in Windows to verify the version.

Useful 0 Not Useful 0

Impact Analysis

A successful exploit could let an attacker gain elevated privileges on the system, potentially leading to unauthorized access, data manipulation, or further compromise of the PowerProtect Data Manager environment.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker with high privileges and remote access to elevate privileges, which could lead to unauthorized access or control over sensitive data. This may violate compliance requirements under GDPR, HIPAA, or other regulations that mandate strict access controls and data protection measures.

Useful 0 Not Useful 0

Mitigation Strategies

Update Dell PowerProtect Data Manager to version 20.2.0.0 or later to address the improper input validation vulnerability in the REST API.

Useful 0 Not Useful 0