CVE-2025-43995

critical · 9.8

Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Authentication Bypass in DSM Data Collector. An unauthenticated remote attacker can access APIs exposed by ApiProxy.war in DataCollectorEar.ear by using a special SessionKey and UserId. These userid are special users created in compellentservicesapi for special purposes.

9.8

CVSS

0.8%

EPSS (exploit prob.)

56th

EPSS percentile

2025-10-24

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-287

Affected products

Vendor	Product	Affected versions
dell	storage_manager	< 2020
dell	storage_manager	2020
dell	storage_manager	2020
dell	storage_manager	2020
dell	storage_manager	2020

Check a specific version with /api/v1/cve/match.

References

https://www.dell.com/support/kbdoc/en-us/000382899/dsa-2025-393-security-update-for-storage-center-dell-storage-manager-vulnerabilities

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-43995