Dell Technologies Discloses Critical Flaws in Storage Manager

 October 24, 2025, Dell Technologies published Security Advisory DSA-2025-393, revealing three serious vulnerabilities in its Dell Storage Manager (DSM) product — used in managing its Storage Center arrays.

The flaws affect versions prior to 2020 R1.21 (often expressed as < 20.1.21) of DSM and potentially enable unauthenticated remote attackers to bypass authentication and gain extensive control of storage systems.

Among the three vulnerabilities, the most critical is tracked as CVE‑2025‑43995, with a CVSS 3.1 base score of 9.8 (Critical). 

---

What the Vulnerabilities Are

CVE-2025-43995 – Improper Authentication (Score: 9.8)

This flaw allows a remote, unauthenticated attacker (i.e., no credentials required) to access APIs exposed by the “ApiProxy.war” component in the DSM “DataCollectorEar.ear” module. By using a specially-crafted SessionKey and UserId (which correspond to internal service accounts in “compellentservicesapi”), the attacker can bypass authentication entirely.

Because the attack vector is “Network”, Attack Complexity is “Low”, Privileges Required are “None” and User Interaction is “None”, the risk is very high. The impact is described as Confidentiality: High, Integrity: High, Availability: High — meaning the attacker could potentially read, modify, or delete data, or disrupt storage services. 

CVE-2025-43994 – Missing Authentication for Critical Function (Score: 8.6)

This vulnerability involves certain critical functions in DSM that lack any authentication check. An unauthenticated attacker with network access could invoke these functions and potentially retrieve or manipulate sensitive configuration or operational data. 

CVE-2025-46425 – XXE (XML External Entity) Vulnerability (Score: 6.5)

Although less severe than the first two, this flaw involves an “Improper Restriction of XML External Entity Reference” (a classic XXE issue) in DSM versions 20.1.20 (and possibly earlier). A low-privileged attacker with remote access could exploit this to view arbitrary files or perform internal network scanning. 

---

Why This Matters

• Storage systems such as those managed by Dell Storage Manager are critical infrastructure for organisations — they hold business-critical data, host virtual machines, backups, and serve as central resources for many applications. A compromise here has far-reaching consequences.

• The fact that one of the vulnerabilities (CVE-43995) allows unauthenticated remote access without user interaction, and gives full access (High impact across confidentiality, integrity, availability) makes it particularly urgent.

• Attackers exploiting these issues could:

  • Gain full administrative control of storage arrays

  • Modify or delete critical data (corrupting backups, disrupting services)

  • Move laterally from storage systems into other enterprise systems

  • Access sensitive metadata or configuration that might expose further attack vectors

• Many organisations may not be aware that their storage management system presents a network-accessible attack surface. Often backups and storage consoles are assumed to be “internal only”, but if mis-configured or reachable, they become targets.

• Given the high CVSS score and ease of exploitation, these vulnerabilities likely will attract attention from attackers, especially in high-value targets (finance, healthcare, critical infrastructure).

---

What Organisations Should Do Immediately

1. Inventory & Identify

• Determine all instances of Dell Storage Manager (DSM) in your environment and note version numbers. The advisory states “versions prior to 2020 R1.21” are vulnerable.

• Check which storage arrays, management consoles, virtualised storage systems are managed through DSM.

• Verify whether the DSM instance is exposed to untrusted networks (internet, partner networks, DMZ) or if it is properly isolated.

2. Restrict Access & Network Segmentation

• Until patched, restrict network access to DSM interfaces and APIs only to trusted administrative machines.

• Use firewalls, network segmentation, and access control lists (ACLs) to limit who can reach the storage management system.

• Disable or spike out any management interfaces that are not required externally.

3. Patch / Upgrade

• Apply the fix published by Dell — upgrade to version 2020 R1.21 or later (or whatever the correct fixed version is for your product variant). Dell’s advisory lists “Remediated Versions – Version 2020 R1.21 or later”.

• Ensure that all storage appliances, DSM consoles, data-collector modules, and associated software are upgraded to non-vulnerable versions.

4. Review and Harden Configuration

• After patching, review configuration: disable unnecessary API endpoints, ensure default/unused accounts are removed or disabled, ensure strong authentication is enforced.

• Enable logging and monitoring of access to storage management systems. Watch for unusual API calls, new sessions, or service-account usage.

• Consider implementing multi-factor authentication (MFA) for management interfaces, if supported.

5. Test and Validate

• Conduct vulnerability scanning or penetration testing on your storage-management infrastructure to ensure the vulnerabilities are remediated and the system is not reachable by unauthorized users.

• Validate that upgrade did not break any operational dependency (backup jobs, replication, array management) and that normal operations continue.

6. Communicate & Document

• Inform stakeholders (storage administrators, DevOps, security operations) about the incident, the need for rapid remediation, and the steps taken.

• Document your patch-management status and any compensating controls implemented to reduce risk until full remediation is complete.

---

Conclusion

The disclosure of these three vulnerabilities in Dell Storage Manager — especially CVE-2025-43995 with its critical score of 9.8 — is a major warning for organisations relying on Dell Storage Center infrastructure. Because the flaws allow unauthenticated remote attackers to bypass authentication and gain full access, the risk cannot be underestimated.

In today’s threat landscape, many adversaries target backup, storage and “less obvious” infrastructure precisely because they are often less patched and monitored than front-line servers. Organisations should treat this advisory as high priority: patch immediately, restrict access, and verify the integrity of your storage management systems.