What is CVE-2025-43995?

CVE-2025-43995 is a critical-severity vulnerability in Dell Storage Manager, classified under Improper Authentication. CVSS score: 9.8/10. Published 2025-10-24.

How severe is CVE-2025-43995?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Dell Storage Manager

CVE-2025-43995

Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Authentication Bypass in DSM Data Collector. An unauthenticated remote attacker can access APIs exposed by ApiProxy.war in DataCollectorEar.ear by using a special SessionKey and UserId. These userid are special users created in compellentservicesapi for special purposes.

Vulnerability class: Broken Authentication

EPSS: 0.008 (53.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Dell Storage Manager — versions N/A
Dell Storage_manager — versions 2020

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

security_alert@emc.com (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2025-43995?: CVE-2025-43995 is a critical-severity vulnerability in Dell Storage Manager, classified under Improper Authentication. CVSS score: 9.8/10. Published 2025-10-24.
How severe is CVE-2025-43995?: Critical severity. CVSS v3 base score is 9.8 out of 10.