Introduction
Many enterprises use Dell Storage Manager as the central platform for managing Dell Storage Center arrays and related products. A newly disclosed vulnerability, CVE-2025-43995, lets remote attackers bypass authentication and gain privileged access to critical storage management APIs. Unauthorized access at that level can lead to data loss, service disruption, and exposure of sensitive business information.
Technical Information
CVE-2025-43995 is an improper authentication vulnerability in Dell Storage Manager version 20.1.21. The flaw is in the Data Collector component, in the APIs exposed by ApiProxy.war within DataCollectorEar.ear.
An attacker exploits it by sending HTTP requests that contain special SessionKey and UserId values. These values belong to service accounts created in the compellentservicesapi for internal operations, and those accounts should not be accessible from outside. The system does not validate their credentials properly, so it accepts them from unauthenticated sources and grants access to sensitive management APIs. From there, the attacker can perform privileged actions on every storage array the affected instance manages.
Patch Information
Dell has released Dell Storage Manager (DSM) version 20.1.21 to fix the following issues:
- CVE-2025-43995: An Improper Authentication vulnerability that could allow unauthenticated remote attackers to bypass protection mechanisms.
- CVE-2025-43994: A Missing Authentication for Critical Function vulnerability that could lead to information disclosure.
- CVE-2025-46425: An Improper Restriction of XML External Entity Reference vulnerability that could result in unauthorized access.
Recommended Action:
Users are strongly advised to upgrade promptly to DSM version 20.1.21 or later. The update addresses these vulnerabilities and protects systems against potential exploits that target them.
Upgrade Steps:
- Back up all critical data before you start the upgrade, to guard against potential data loss.
- Download the latest DSM version from the Dell Support website.
- Apply the update by following the provided installation instructions.
- After installation, confirm that the DSM version is 20.1.21 or later.
Patch source: Dell Security Advisory DSA-2025-393
Affected Systems and Versions
CVE-2025-43995 affects Dell Storage Center - Dell Storage Manager version 20.1.21, the only version confirmed as vulnerable. The flaw is present in configurations where the Data Collector is deployed and exposes the ApiProxy.war interface. The available advisories list no other versions or products as affected.
Vendor Security History
Dell Storage Manager has a documented history of authentication-related vulnerabilities. Previous issues include CVE-2024-38298 (authentication bypass), CVE-2025-43994 (missing authentication for critical function), and CVE-2025-46425 (improper restriction of XML external entity reference). Dell usually responds with coordinated advisories and patches, but similar flaws keep recurring, which suggests the product line still struggles to secure its authentication mechanisms.
