PT-2025-43623 · Dell · Dell Storage Manager

Published 2025-10-24 · Updated 2025-12-01 · CVE-2025-43995

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell Storage Manager versions 20.1.21

Description An improper authentication issue exists in Dell Storage Manager that could allow an unauthenticated remote attacker to bypass protection mechanisms. Specifically, an attacker can access APIs exposed by ApiProxy.war within DataCollectorEar.ear by utilizing a specific SessionKey and UserId. These UserId values are associated with special users created within compellentservicesapi for specific purposes.

Recommendations Update Dell Storage Manager to a version that addresses this authentication bypass. As a temporary workaround, restrict access to the ApiProxy.war component within DataCollectorEar.ear to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-43995

Affected Products

Dell Storage Manager

References · 13

• https://dell.com/support/kbdoc/en-us/000382899/dsa-2025-393-security-update-for-storage-center-dell-storage-manager-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-43995 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43995 · Security Note
• https://twitter.com/Komodosec/status/1995632650850369642 · Twitter Post
• https://twitter.com/CveTodo/status/1983098166057595000 · Twitter Post
• https://t.me/pentestingnews/70099 · Telegram Post
• https://twitter.com/ZeroPathLabs/status/1981751662986326414 · Twitter Post
• https://t.me/CVEtracker/35678 · Telegram Post
• https://reddit.com/r/pwnhub/comments/1oho6k5/critical_vulnerabilities_in_dell_storage_manager · Reddit Post
• https://twitter.com/offseq/status/1981986690534097304 · Twitter Post
• https://twitter.com/Karma_X_Inc/status/1982645758261096948 · Twitter Post
• https://twitter.com/CCBalert/status/1982827823048847815 · Twitter Post
• https://twitter.com/cracbot/status/1983489046262448300 · Twitter Post