Dell Storage Manager Auth Bypass & XXE Vulnerabilities (CVE-2025-43984, CVE-2025-46427)

Critical Vulnerability Information Vulnerability Overview Advisory ID: DSA-2025:393 Title: Security Update for Storage Center - Dell Storage Manager Vulnerabilities Summary: Multiple security vulnerabilities exist in Dell Storage Manager that could be exploited by malicious users to compromise systems. Impact CVSS Score: - CVE-2025-43984: 8.6 - CVE-2025-46427: 6.5 Vulnerability Details 1. CVE-2025-43984 - Description: An authentication bypass vulnerability exists in Dell Storage Manager version 20.1.21. Due to insufficient authentication checks on a specific API, remote attackers may exploit this vulnerability to access sensitive information. - CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H 2. CVE-2025-46427 - Description: An external entity reference vulnerability exists in Dell Storage Manager version 20.1.21. Through specially crafted XML input, remote attackers may exploit this vulnerability to cause a denial of service or unauthorized access. - CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H Affected Products and Remediation Product: Dell Storage Manager Affected Versions: All versions prior to 20.20.70.21 Fixed Versions: 20.20.70.21 or later Link: Dell Support Acknowledgments CVE-2025-43984: Thanks to Tenable for reporting this issue. CVE-2025-46427: Thanks to Ahmed Y. Elmaghraby for reporting this issue. Related Information Dell Security Advisories and Notices Dell Vulnerability Response Policy PVSS Scoring Guide

Goal Reached Thanks to every supporter — we hit 100%!

Dell Storage Manager Auth Bypass & XXE Vulnerabilities (CVE-2025-43984, CVE-2025-46427)