CVE-2025-43995

CriticalCVSS 9.8

Published: 24/10/2025(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.84%

56th percentile - higher than 56% of all known CVEs

Summary

Dell Storage Manager version 20.1.21 contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Authentication Bypass in DSM Data Collector allows access to APIs exposed by ApiProxy.war in DataCollectorEar.ear using a special SessionKey and UserId.

Risk Assessment

An unauthenticated attacker can gain access to sensitive APIs and data, potentially leading to confidentiality and integrity breaches in storage management systems.

Recommendation

Apply vendor-provided patches or update Dell Storage Manager to a version that fixes this vulnerability.

Other vulnerabilities in Dell Storage Manager

CVE-2017-14374Critical
The SMI-S service in Dell Storage Manager versions earlier than 16.3.20 is protected using a hard-coded password. A remote user with knowledge of the password might potentially disable the SMI-S service via HTTP requests, affecting storage management and monitoring functionality via the SMI-S interface.

Original NVD description (English source)

Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Authentication Bypass in DSM Data Collector. An unauthenticated remote attacker can access APIs exposed by ApiProxy.war in DataCollectorEar.ear by using a special SessionKey and UserId. These userid are special users created in compellentservicesapi for special purposes.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS