CVE-2017-14374
CriticalSummary
The SMI-S service in Dell Storage Manager versions earlier than 16.3.20 is protected using a hard-coded password. A remote user with knowledge of the password might potentially disable the SMI-S service via HTTP requests, affecting storage management and monitoring functionality via the SMI-S interface.
Risk Assessment
The risk to the organization is the potential for remote disabling of the storage management service, which could lead to disruptions in data monitoring and management.
Recommendation
It is recommended to update Dell Storage Manager to version 16.3.20 or later to remove the hard-coded password and secure the SMI-S service.
Other vulnerabilities in Dell Storage Manager
See all- CVE-2025-43995Critical
Dell Storage Manager version 20.1.21 contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Authentication Bypass in DSM Data Collector allows access to APIs exposed by ApiProxy.war in DataCollectorEar.ear using a special SessionKey and UserId.
- CVE-2025-43994High
Dell Storage Center - Dell Storage Manager, version(s) DSM 20.1.21, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
- CVE-2025-46425Medium
Dell Storage Manager version 20.1.20 contains an improper restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could exploit it, leading to unauthorized access.
Original NVD description (English source)
The SMI-S service in Dell Storage Manager versions earlier than 16.3.20 (aka 2016 R3.20) is protected using a hard-coded password. A remote user with the knowledge of the password might potentially disable the SMI-S service via HTTP requests, affecting storage management and monitoring functionality via the SMI-S interface. This issue, aka DSM-30415, only affects a Windows installation of the Data Collector (not applicable to the virtual appliance).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS