CVE-2025-43995
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
Dell Storage Manager version 20.1.21 contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Authentication Bypass in DSM Data Collector allows access to APIs exposed by ApiProxy.war in DataCollectorEar.ear using a special SessionKey and UserId.
Risk Assessment
An unauthenticated attacker can gain access to sensitive APIs and data, potentially leading to confidentiality and integrity breaches in storage management systems.
Recommendation
Apply vendor-provided patches or update Dell Storage Manager to a version that fixes this vulnerability.
Other vulnerabilities in Dell Storage Manager
See all- CVE-2017-14374Critical
The SMI-S service in Dell Storage Manager versions earlier than 16.3.20 is protected using a hard-coded password. A remote user with knowledge of the password might potentially disable the SMI-S service via HTTP requests, affecting storage management and monitoring functionality via the SMI-S interface.
- CVE-2025-43994High
Dell Storage Center - Dell Storage Manager, version(s) DSM 20.1.21, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
- CVE-2025-46425Medium
Dell Storage Manager version 20.1.20 contains an improper restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could exploit it, leading to unauthorized access.
Original NVD description (English source)
Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Authentication Bypass in DSM Data Collector. An unauthenticated remote attacker can access APIs exposed by ApiProxy.war in DataCollectorEar.ear by using a special SessionKey and UserId. These userid are special users created in compellentservicesapi for special purposes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS