Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes

CVE-2021-21551 is an insufficient access control flaw (CWE-782) in Dell's dbutil_2_3.sys driver, present on Dell systems for roughly 12 years before being patched. A local, authenticated user can trigger the flaw by sending crafted requests (IOCTLs) to the driver, gaining the ability to read and write arbitrary memory. An attacker who exploits it can escalate privileges (typically to kernel/SYSTEM level), cause a denial of service, or disclose information, making it a useful stepping stone for post-compromise attacks. Any Dell machine that shipped or ran the dbutil driver — used in Dell support and BIOS/BIOS-update tooling — is affected, and public reporting indicates hundreds of millions of Dell PCs are exposed. The flaw is actively exploited: it is listed in CISA's Known Exploited Vulnerabilities Catalog (added 2022-03-31), public PoCs exist, and the Lazarus APT reportedly used it in attacks to deploy a rootkit; EPSS puts the 30-day exploitation probability at 79.2%.

Do: Apply Dell's updated driver/firmware per vendor instructions, as required by CISA's KEV catalog. Inventory your fleet for the dbutil_2_3.sys driver file (commonly found with Dell support tools and BIOS update utilities) and prioritize patching endpoints, since the bug requires only local user access. Hunt for signs of local privilege-escalation activity consistent with public PoCs, given documented Lazarus APT use to deploy a rootkit.

Dell RecoverPoint for Virtual Machines (RP4VMs) versions prior to 6.0.3.1 HF1 contain hard-coded credentials (CWE-798) for the appliance's underlying operating system. An unauthenticated remote attacker who knows the hard-coded credential can authenticate over the network with no user interaction and gain root-level access and persistence on the underlying OS — beyond just the RecoverPoint application — which is why the flaw scores a maximum CVSS of 10.0 with scope changed. Any organization running an affected RP4VMs release is exposed, with risk highest where appliance management interfaces are reachable from broader networks. The vulnerability is confirmed exploited in the wild: it was added to CISA's KEV catalog on 2026-02-18, and reporting indicates China-linked actors exploited it as a zero-day since at least 2024, prompting an emergency federal patch directive; related coverage ties the activity to the China-linked VerdantBamboo actor deploying BRICKSTORM-family backdoors on appliances.

Do: Upgrade all RP4VMs appliances to 6.0.3.1 HF1 or apply Dell's published remediations immediately — federal agencies must patch per BOD 22-01 by the KEV deadline (reported as 'by Saturday'). Because exploitation has occurred since at least 2024, treat deployed appliances as potentially compromised: review the underlying OS for unexpected accounts, modified services, and root persistence, and restrict the appliance's management/replication network reachability until patched.

Dell Container Storage Modules (CSM) before v1.18.0 ships a csm-authorization-storage gRPC server that fails to authenticate callers on a critical function (CWE-306). An unauthenticated remote attacker who can reach the gRPC endpoint can invoke that function and retrieve the storage backend administrator credentials for every storage array registered with the CSM Authorization module. Because those credentials typically grant full administrative control of the underlying storage systems, the flaw can cascade into complete compromise of storage and, by extension, the Kubernetes workloads depending on it. The bug scores a perfect CVSS 3.1 of 10.0 (network, low complexity, no privileges or user interaction, scope change, high impact to confidentiality, integrity, and availability). Dell has patched the issue and is urging admins to apply updates promptly, but there is no known public PoC and no confirmed in-the-wild exploitation, and it is not yet on the CISA KEV list.

Do: Upgrade Dell CSM to v1.18.0 or later immediately, prioritizing any cluster running the CSM Authorization module. Until patched, restrict network access to the csm-authorization-storage gRPC server (e.g., Kubernetes NetworkPolicies and firewall rules limiting reachability to trusted pods/segments only) and verify it is not exposed outside the cluster. After patching, rotate the administrator credentials for all registered storage arrays and audit logs for unexplained gRPC calls or suspicious storage-array logins, since the credentials could have been silently harvested before the fix.

Dell Container Storage Modules before 1.18.0 fail to neutralize special elements in a template engine (CWE-1336), a template-injection flaw. A remote attacker who already has low privileges can trigger it over the network with low complexity and no user interaction. Because the scope changes, the impact extends beyond the vulnerable component, with high confidentiality and integrity impact and no availability impact stated in the CVSS vector (9.6 critical), resulting in privilege escalation. Sites running Dell CSM for container storage on Kubernetes are affected if they have not moved to 1.18.0. No public proof of concept is known and the issue is not in CISA KEV, so exploitation in the wild is not known; related reporting urges prompt patching of critical CSM flaws.

Do: Upgrade Dell Container Storage Modules to version 1.18.0 or later. Until that is done, limit network access to CSM interfaces to trusted administrators and review low-privilege accounts that can reach the template features.