Critical Dell Storage Manager Flaw (CVE-2025-43995, CVSS 9.8) Allows Unauthenticated API Bypass

Dell Technologies has issued a critical advisory about multiple high-severity vulnerabilities in its Storage Center and Storage Manager (DSM) software, including CVE-2025-43995 with a CVSS of 9.8 that could allow an unauthenticated API bypass.

According to Dell’s advisory, CVE-2025-43995 affects the DSM Data Collector component, exposing APIs through ApiProxy[.]war in DataCollectorEar[.]ear and enabling an unauthenticated remote attacker to access these APIs using a special SessionKey and UserId, effectively granting administrative-level interaction with protected storage management functions. The advisory notes that this could lead to a protection mechanism bypass, as attackers bypass normal authentication controls.

A second flaw, CVE-2025-43994 (CVSS 8.6), concerns missing authentication for a critical function in the same DSM version, potentially allowing information disclosure, while a third, medium-severity flaw, CVE-2025-46425 (CVSS 6.5), involves XML External Entity references due to improper XML parsing. Dell lists remediation in version 2020 R1.22, addressing the authentication and XXE flaws in full, with affected versions cited as prior to 2020 R1.21.