CVE-2025-43995CWE-287

CVE-2025-43995

Critical · published October 24, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
57.3
In the wild
Unconfirmed
What it is

🚨 An unauthenticated remote access exploit is lurking in Dell Storage Manager! This vulnerability could allow attackers to bypass authentication altogether, creating a recipe for chaos. 🔥 Think of this vulnerability like a hotel with a back entrance no one thought to lock — anyone with the right code can waltz right in without a reservation! An unauthenticated attacker could potentially gain access to sensitive data and APIs, leading to a total compromise of the system's protection mechanisms. This is absolutely devastating, as it opens the floodgates for unauthorized actions with serious consequences.

Put simply

Think of this vulnerability like a hotel with a back entrance no one thought to lock — anyone with the right code can waltz right in without a reservation! CVE-2025-43995 is an Improper Authentication vulnerability that allows unauthenticated attackers to exploit the APIs exposed by ApiProxy.war in DataCollectorEar.ear using a crafted SessionKey and UserId, which were intended for special internal purposes.

What to do

An unauthenticated attacker could potentially gain access to sensitive data and APIs, leading to a total compromise of the system's protection mechanisms. This is absolutely devastating, as it opens the floodgates for unauthorized actions with serious consequences. Immediately patch Dell Storage Manager to version 20.1.22 or later to mitigate this risk. Review your API access control measures, and ensure that authentication checks are robust to prevent unauthorized exploitation. Secure those back doors! You've got this! By taking these steps, you can lock down your systems and keep your data safe. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00837 · 57.3th percentile
Weakness
CWE-287 · Improper Authentication
Published
2025-10-24T19:15Z
Affected products (5)
ProductVersionsFixed in
dell/storage_manager< 20202020
dell/storage_managerall versions—
dell/storage_managerall versions—
dell/storage_managerall versions—
dell/storage_managerall versions—
References (1)
EPSS history
Timeline
  • 24 OCT 14:09Z
    Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability
    cvelistv5