Dell Technologies has recently identified and disclosed three critical vulnerabilities within its Storage Manager software, which could potentially allow attackers to bypass authentication mechanisms, access sensitive information, and gain unauthorized control over affected systems. These vulnerabilities, announced on October 24, 2025, impact versions of Dell Storage Manager up to 20.1.21, posing significant security risks to organizations that utilize this tool for managing their storage arrays.
Overview of the Vulnerabilities
The identified vulnerabilities have been assigned Common Vulnerabilities and Exposures (CVE) identifiers and have received Common Vulnerability Scoring System (CVSS) base scores ranging from 6.5 to 9.8, indicating varying levels of severity. These flaws underscore the persistent challenges in securing management interfaces, as they could potentially be exploited remotely without requiring user interaction.
CVE-2025-43995: Improper Authentication in DSM Data Collector
The most severe of the three vulnerabilities, CVE-2025-43995, has been assigned a CVSS base score of 9.8, classifying it as critical. This flaw resides in the Data Collector component of Dell Storage Manager (DSM). An unauthenticated attacker with remote access can exploit exposed APIs within the ApiProxy.war file located in the DataCollectorEar.ear directory. By crafting a specific SessionKey and UserId, the attacker can leverage special user accounts created internally within the Compellent Services API, effectively bypassing authentication mechanisms.
Exploitation of this vulnerability could lead to a complete system compromise, affecting the confidentiality, integrity, and availability of the system. The CVSS vector string for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating that the attack can be executed remotely over a network with low complexity, does not require privileges or user interaction, and has a high impact on the system.
CVE-2025-43994: Missing Authentication for Critical Function
The second vulnerability, CVE-2025-43994, has been assigned a CVSS base score of 8.6. This flaw involves a missing authentication check for a critical function within DSM version 20.1.21. An unauthenticated remote attacker can exploit this vulnerability to disclose sensitive information and disrupt service availability.
The CVSS vector string for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, indicating that the attack can be executed remotely over a network with low complexity, does not require privileges or user interaction, and has a low impact on confidentiality and integrity but a high impact on availability.
Attackers could extract configuration data or operational details, potentially facilitating broader network intrusions.
CVE-2025-46425: Improper Restriction of XML External Entity References
The third vulnerability, CVE-2025-46425, affects DSM version 20.1.20 and has been assigned a CVSS base score of 6.5. This flaw involves improper restriction of XML external entity (XXE) references. A remote attacker with low privileges can exploit this vulnerability to read sensitive files, leading to unauthorized access without directly impacting the integrity or availability of the system.
The CVSS vector string for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating that the attack can be executed remotely over a network with low complexity, requires low privileges, does not require user interaction, and has a high impact on confidentiality but no impact on integrity and availability.
This XXE flaw highlights the risks associated with parsing untrusted XML inputs in storage management tools.
Summary of Vulnerabilities
| CVE ID | Description | CVSS Base Score | Vector String |
|——————|——————————————-|—————–|—————————————————-|
| CVE-2025-43995 | Improper Authentication (Bypass) | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVE-2025-43994 | Missing Authentication (Disclosure) | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H |
| CVE-2025-46425 | XXE Reference Vulnerability | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Recommendations and Remediation
Dell Technologies strongly advises customers to assess the risks associated with these vulnerabilities by considering both the base and environmental CVSS scores. Immediate updates are recommended to mitigate potential threats.
The affected products include Dell Storage Manager versions prior to 2020 R1.21. Remediation is available in version 2020 R1.22 or later, which can be downloaded from Dell’s support site for Storage SC2000 drivers.
The advisory was promptly revised on the same day to refine remediation guidance. Credit for discovering CVE-2025-43994 and CVE-2025-43995 goes to Tenable, while independent researcher Ahmed Y. Elmogy is credited for identifying CVE-2025-46425.
As enterprises increasingly rely on storage solutions for their data centers, these disclosures serve as a critical reminder to prioritize authentication hardening and regular vulnerability scanning. Although no active exploitation has been reported to date, the ease of remote access associated with these vulnerabilities makes swift action essential to prevent potential breaches.
