Critical · published October 24, 2025
🚨 An unauthenticated remote access exploit is lurking in Dell Storage Manager! This vulnerability could allow attackers to bypass authentication altogether, creating a recipe for chaos. 🔥 Think of this vulnerability like a hotel with a back entrance no one thought to lock — anyone with the right code can waltz right in without a reservation! An unauthenticated attacker could potentially gain access to sensitive data and APIs, leading to a total compromise of the system's protection mechanisms. This is absolutely devastating, as it opens the floodgates for unauthorized actions with serious consequences.
Think of this vulnerability like a hotel with a back entrance no one thought to lock — anyone with the right code can waltz right in without a reservation! CVE-2025-43995 is an Improper Authentication vulnerability that allows unauthenticated attackers to exploit the APIs exposed by ApiProxy.war in DataCollectorEar.ear using a crafted SessionKey and UserId, which were intended for special internal purposes.
An unauthenticated attacker could potentially gain access to sensitive data and APIs, leading to a total compromise of the system's protection mechanisms. This is absolutely devastating, as it opens the floodgates for unauthorized actions with serious consequences. Immediately patch Dell Storage Manager to version 20.1.22 or later to mitigate this risk. Review your API access control measures, and ensure that authentication checks are robust to prevent unauthorized exploitation. Secure those back doors! You've got this! By taking these steps, you can lock down your systems and keep your data safe. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| dell/storage_manager | < 2020 | 2020 |
| dell/storage_manager | all versions | — |
| dell/storage_manager | all versions | — |
| dell/storage_manager | all versions | — |
| dell/storage_manager | all versions | — |