Read the docs
TI-2017-10486 Aliases CVE-2017-14374GHSA-6457-f4qf-pj52

Hard-coded credentials in Dell Storage Manager 2016 Dell Storage Manager versions earlier…

Priority MEDIUM 45CWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-798.

Summary

The SMI-S service in Dell Storage Manager versions earlier than 16.3.20 (aka 2016 R3.20) is protected using a hard-coded password. A remote user with the knowledge of the password might potentially disable the SMI-S service via HTTP requests, affecting storage management and monitoring functionality via the SMI-S interface. This issue, aka DSM-30415, only affects a Windows installation of the Data Collector (not applicable to the virtual appliance).

Why it matters now

EPSS 0.0132 71st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Dell Storage Manager 2016 Dell Storage Manager versions earlier than 16.3.20Dell Storage Manager 2016 Dell Storage Manager versions earlier than 16.3.20—No fix listedCNA
  • Dell Storage Manager 2016 Dell Storage Manager versions earlier than 16.3.20 Vendor— Affected Dell Storage Manager 2016 Dell Storage Manager versions earlier than 16.3.20 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dell:storage_manager:*:*:*:*:*:*:*:*before 16.3.20VulnerableDell
  • cpe:2.3:a:dell:storage_manager:*:*:*:*:*:*:*:* Versions before 16.3.20 Vulnerable ·Dell

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-14374
  2. 2026-10-03 Alias added: GHSA-6457-f4qf-pj52

References

Advisory 1

  • TI-2025-28548 Improper authentication in Dell Storage Manager CVSS 3.1CRITICAL 9.8
  • TI-2025-28547 Missing authentication in Dell Storage Manager CVSS 3.1HIGH 8.6
  • TI-2025-16368 Improper authentication in Dell Storage Center - Dell Storage Manager CVSS 3.1HIGH 8.8
  • TI-2025-16369 XML external entity injection in Dell Storage Center - Dell Storage Manager CVSS 3.1HIGH 8.1
  • TI-2025-16367 Command injection in Dell Storage Center - Dell Storage Manager CVSS 3.1HIGH 8.0
  • TI-2017-10494 Path traversal in Dell Storage Manager CVSS 3.0MEDIUM 6.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences