BaseFortify

Publication date: 2025-10-24

Last updated on: 2025-11-04

Assigner: Dell

Description

Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Authentication Bypass in DSM Data Collector. An unauthenticated remote attacker can access APIs exposed by ApiProxy.war in DataCollectorEar.ear by using a special SessionKey and UserId. These userid are special users created in compellentservicesapi for special purposes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-24

Last Modified

2025-11-04

Generated

2026-07-06

AI Q&A

2025-10-24

EPSS Evaluated

2026-07-05

NVD

CVE-2025-43995

Affected Vendors & Products

Vendor	Product	Version / Range
dell	storage_manager	to 2020 (exc)
dell	storage_manager	2020
dell	storage_manager	2020
dell	storage_manager	2020
dell	storage_manager	2020

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability is an Improper Authentication issue in Dell Storage Center - Dell Storage Manager version 20.1.21. An unauthenticated remote attacker can exploit it by accessing APIs exposed by ApiProxy.war in DataCollectorEar.ear using special SessionKey and UserId values. These special user IDs are created for specific purposes in compellentservicesapi, allowing the attacker to bypass protection mechanisms and authentication controls.

Impact Analysis

The vulnerability allows an unauthenticated remote attacker to bypass authentication and gain unauthorized access to sensitive APIs. This can lead to a complete compromise of confidentiality, integrity, and availability of the affected system, potentially allowing the attacker to manipulate data, disrupt services, or gain further access within the environment.

Hi! I’m here to help you understand CVE-2025-43995. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70