CVE-2025-46425
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Dell Storage Manager version 20.1.20 contains an improper restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could exploit it, leading to unauthorized access.
Risk Assessment
The vulnerability could allow an attacker to read files or perform server-side requests, potentially leading to data confidentiality breaches.
Recommendation
Apply vendor-provided patches and restrict access to the service to trusted users only.
Other vulnerabilities in Dell Storage Manager
See all- CVE-2025-43995Critical
Dell Storage Manager version 20.1.21 contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Authentication Bypass in DSM Data Collector allows access to APIs exposed by ApiProxy.war in DataCollectorEar.ear using a special SessionKey and UserId.
- CVE-2017-14374Critical
The SMI-S service in Dell Storage Manager versions earlier than 16.3.20 is protected using a hard-coded password. A remote user with knowledge of the password might potentially disable the SMI-S service via HTTP requests, affecting storage management and monitoring functionality via the SMI-S interface.
- CVE-2025-43994High
Dell Storage Center - Dell Storage Manager, version(s) DSM 20.1.21, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
Original NVD description (English source)
Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS