CVE-2019-18580

Dell EMC Storage Monitoring and Reporting 4.3.1 has a flaw that allows attackers to send specially crafted messages over the network to run malicious code on the server without needing a password. This is dangerous because an attacker anywhere on the internet can take complete control of the system.

The vulnerability exists in Java RMI deserialization of untrusted data (CWE-502). An unauthenticated remote attacker can send a crafted RMI request that causes unsafe deserialization, leading to arbitrary code execution on the target host. The attack vector is network-based with no authentication or user interaction required, resulting in critical confidentiality, integrity, and availability impact.