Introduction
Unrestricted access to storage management functions can expose sensitive configuration and operational data to remote attackers. In enterprise environments that run Dell Storage Center, one missing authentication check in Dell Storage Manager version 20.1.21 (CVE-2025-43994) could let an unauthenticated attacker retrieve or manipulate critical storage information over the network.
Dell Technologies is a major global IT vendor with a large presence in enterprise storage, servers, and networking. Dell Storage Manager is the core management platform for Storage Center arrays and is widely deployed in data centers worldwide, so its security directly affects the resilience of the storage infrastructure it manages.
Technical information
CVE-2025-43994 is classified as a missing authentication for critical function vulnerability (CWE-306) in Dell Storage Manager version 20.1.21. The application exposes certain management functions over the network and does not enforce authentication on them. Any remote attacker with network access can interact with these functions without credentials and without user interaction.
An attacker can exploit the vulnerability with standard network requests. Attack complexity is low, and no privileges are required. Depending on which functions are exposed, an attacker can potentially access sensitive configuration data or modify storage settings. The CVSS v3.1 base score is 8.6, which reflects the high impact and the ease of exploitation.
A related vulnerability in the same product line, CVE-2025-43995, is an improper authentication flaw in the DataCollectorEar.ear component. Attackers can access its APIs by supplying special SessionKey and UserId values. This suggests that authentication logic may be applied inconsistently, or that the way the product manages credentials and sessions has architectural weaknesses.
No public code snippets or proof-of-concept exploit details are available for CVE-2025-43994.
Affected systems and versions
- Dell Storage Manager version 20.1.21 is affected.
- It is the only version that public advisories explicitly list as vulnerable.
- The vulnerability is present in default configurations where management interfaces are reachable over the network.
Vendor security history
Dell Technologies has had several notable vulnerabilities in its storage management products:
- CVE-2025-43727: Authentication bypass in Dell PowerProtect Data Domain (RestAPI component)
- CVE-2025-22478: XXE in Dell Storage Manager 20.1.20
- CVE-2025-43995: Improper authentication in Dell Storage Manager 20.1.21
Dell typically issues coordinated advisories and releases patches promptly. Even so, authentication and input validation flaws keep recurring in its storage management products, which suggests ongoing problems in its secure development and code review processes.
