Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulne

The Improper Authentication vulnerability in Dell Storage Manager allows an unauthenticated, remote attacker to bypass protection mechanisms. Specifically, they can exploit the vulnerability to access APIs exposed by ApiProxy.war within the DataCollectorEar.ear component. This access is achieved by crafting a special SessionKey and UserId, leveraging pre-configured users created for specific purposes within the componentservicesapi. Successful exploitation could lead to unauthorized data access, modification, or deletion, potentially compromising the integrity and confidentiality of stored data. The ability to bypass authentication significantly expands the attack surface, allowing attackers to gain deeper access to the storage system without proper credentials.

Organizations utilizing Dell Storage Manager in environments with remote access enabled, particularly those running versions prior to 2020 R1.21, are at significant risk. Shared hosting environments where multiple tenants share the same storage infrastructure are also particularly vulnerable, as a compromised tenant could potentially exploit this vulnerability to access data belonging to other tenants.

• windows / supply-chain:

Get-Process -Name DSMDataCollector | Select-Object ProcessId, CommandLine

• linux / server:

ps aux | grep DSMDataCollector

• generic web:

curl -I <dell_storage_manager_ip>/ApiProxy.war

1. 2025-10-24Disclosure

   disclosure

1. Reservado2025-04-21
2. Publicada2025-10-24
3. Modificada2026-02-26
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2025-43995 is to upgrade Dell Storage Manager to version 2020 R1.21 or later, which contains the fix for this vulnerability. If immediate upgrade is not feasible, consider implementing network segmentation to restrict remote access to the DataCollectorEar.ear component. Review and restrict access to the componentservicesapi to limit the potential impact of successful exploitation. Monitor API access logs for unusual activity, focusing on requests with suspicious SessionKeys or UserIDs. While a WAF may not directly prevent this authentication bypass, it can be configured to detect and block suspicious API requests based on known patterns.