Dell Storage Manager Vulnerabilities Allow Full System Compromise

Dell Technologies has disclosed three critical vulnerabilities in Dell Storage Manager that could allow unauthenticated remote attackers to fully compromise storage systems. The vulnerabilities affect versions prior to 2020 R1.21, with the most severe, CVE-2025-43995, having a CVSS score of 9.8, allowing attackers to bypass authentication and gain unrestricted access.

Another vulnerability, CVE-2025-43994, with a CVSS score of 8.6, enables unauthorized access to critical functions, leading to potential information disclosure. Additionally, CVE-2025-46425 presents an XML external entity vulnerability with a CVSS score of 6.5, which could be exploited in multi-stage attacks. Dell recommends upgrading to version 2020 R1.22 or later to mitigate these risks.