CVE-2025-43937
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Dell PowerScale OneFS versions prior to 9.12.0.0 contain an insertion of sensitive information into log file vulnerability. A low privileged attacker with local access could exploit this to disclose certain user credentials. The attacker may use the exposed credentials to access the application with the privileges of the compromised account.
Risk Assessment
The risk involves potential account takeover and unauthorized access to sensitive data in PowerScale. Exposed credentials could lead to unauthorized access and privilege escalation.
Recommendation
Immediately upgrade Dell PowerScale OneFS to version 9.12.0.0 or later. Also review and sanitize log files for any sensitive data and monitor logs for suspicious activity.
Other vulnerabilities in Dell PowerScale OneFS
See all- CVE-2026-22278High
Dell PowerScale OneFS versions prior to 9.13.0.0 contain an improper restriction of excessive authentication attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.
- CVE-2026-70425Medium
Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 through 9.10.1.0, and Versions 9.11.0.0 through 9.14.0.1, contain a command injection vulnerability. An admin privileged local attacker could potentially exploit this vulnerability, leading to elevation of privileges to root, impacting confidentiality, integrity, and availability.
- CVE-2026-46460Low
Dell PowerScale OneFS versions 9.5.0.0 through 9.7.1.15, 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0 contain an Incorrect Authorization vulnerability. A low privileged adjacent network attacker could exploit this, leading to unauthorized modification of system logs.
- CVE-2026-40635Medium
Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to denial of service and information tampering.
- CVE-2026-40633High
A vulnerability in Dell PowerScale OneFS allows insertion of sensitive information into log files. A low-privileged attacker with local access could exploit this flaw to disclose confidential data.
- CVE-2026-49501Medium
A vulnerability in Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7 and 9.11.0.0 through 9.13.0.2 is due to improper privilege management. It allows a local attacker with high privileges to escalate privileges.
- CVE-2025-43935Medium
Dell PowerScale OneFS versions prior to 9.12.0.0 contain an improper resource shutdown or release vulnerability. A high privileged attacker with local access could exploit this to cause a denial of service.
- CVE-2025-43883Medium
Dell PowerScale OneFS versions prior to 9.12.0.0 contain an improper check for unusual or exceptional conditions vulnerability. A high privileged attacker with local access could exploit this to cause a denial of service.
- CVE-2026-27102Medium
Incorrect privilege assignment in Dell PowerScale OneFS versions 9.5.0.0-9.10.1.6 and 9.11.0.0-9.13.0.1 allows a low-privileged local attacker to escalate privileges.
- CVE-2026-24511Medium
A vulnerability in Dell PowerScale OneFS causes error messages to contain sensitive information. Versions 9.5.0.0 through 9.10.1.6 and 9.11.0.0 through 9.13.0.0 are affected.
Original NVD description (English source)
Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an insertion of sensitive information into log file vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS