TI-2025-28548 Aliases CVE-2025-43995 GHSA-q4x9-46wj-f2cj

Improper authentication in Dell Storage Manager

MEDIUM 50CWE-287Published 2025-10-24 · Updated 2026-02-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Authentication Bypass in DSM Data Collector. An unauthenticated remote attacker can access APIs exposed by ApiProxy.war in DataCollectorEar.ear by using a special SessionKey and UserId. These userid are special users created in compellentservicesapi for special purposes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00837 57th percentileScored 2026-11-07

Fix Fixed Dell Storage Manager (Dell): 2020 R1.21

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dell	Dell Storage Manager	N/A to before 2020 R1.21	2020 R1.21	Patch available	CNA

Dell Storage Manager VendorDell Affected N/A to before 2020 R1.21 Fixed in 2020 R1.21 Patch available CNA

CPE configurations NVD · 5

CPE	Versions	Role	Vendor
cpe:2.3:a:dell:storage_manager::::::::	before 2020	Vulnerable	Dell
cpe:2.3:a:dell:storage_manager:2020:r1::::::	2020 r1	Vulnerable	Dell
cpe:2.3:a:dell:storage_manager:2020:r1.10::::::	2020 r1.10	Vulnerable	Dell
cpe:2.3:a:dell:storage_manager:2020:r1.2::::::	2020 r1.2	Vulnerable	Dell
cpe:2.3:a:dell:storage_manager:2020:r1.20::::::	2020 r1.20	Vulnerable	Dell

cpe:2.3:a:dell:storage_manager:*:*:*:*:*:*:*:* Versions before 2020 Vulnerable ·Dell
cpe:2.3:a:dell:storage_manager:2020:r1:*:*:*:*:*:* Versions 2020 r1 Vulnerable ·Dell
cpe:2.3:a:dell:storage_manager:2020:r1.10:*:*:*:*:*:* Versions 2020 r1.10 Vulnerable ·Dell
cpe:2.3:a:dell:storage_manager:2020:r1.2:*:*:*:*:*:* Versions 2020 r1.2 Vulnerable ·Dell
cpe:2.3:a:dell:storage_manager:2020:r1.20:*:*:*:*:*:* Versions 2020 r1.20 Vulnerable ·Dell

Remediation

Fix · CNA Dell Storage Manager (Dell) Fixed in 2020 R1.21

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2025-10-24
Dell Storage Manager — dell.com/support/kbdoc/en-us/000382899/dsa-2025-393-securit…
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-28547 Missing authentication in Dell Storage ManagerPriority MEDIUM 44
- TI-2025-29146 XML external entity injection in Dell Storage ManagerPriority LOW 31
Show all 3 records → Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-43995
2026-10-03 Alias added: GHSA-q4x9-46wj-f2cj

References

Advisory 1

https://www.dell.com/support/kbdoc/en-us/000382899/dsa-2025-393-security-update-for-storage-center-dell-storage-manager-vulnerabilities

TI-2017-10486 Hard-coded credentials in Dell Storage Manager 2016 Dell Storage Manager versions earlier… CVSS 3.0CRITICAL 9.8
TI-2025-28547 Missing authentication in Dell Storage Manager CVSS 3.1HIGH 8.6
TI-2025-16368 Improper authentication in Dell Storage Center - Dell Storage Manager CVSS 3.1HIGH 8.8
TI-2025-16369 XML external entity injection in Dell Storage Center - Dell Storage Manager CVSS 3.1HIGH 8.1
TI-2025-16367 Command injection in Dell Storage Center - Dell Storage Manager CVSS 3.1HIGH 8.0
TI-2017-10494 Path traversal in Dell Storage Manager CVSS 3.0MEDIUM 6.5

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences