What is the CVSS score of CVE-2025-43935?

CVE-2025-43935 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2025-43935?

Yes, a patch is available for CVE-2025-43935. Update the affected software to the latest version immediately.

PowerScale OneFS CVE-2025-43935

EUVD-2025-209504 MEDIUM

Improper Resource Shutdown or Release (CWE-404)

2026-04-16 dell

GHSA-4rvm-g2vh-jm4x

Dell Denial Of Service Powerscale Onefs

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.4 MEDIUM

Local access with high privileges required; no confidentiality or integrity impact; availability-only DoS consistent with resource exhaustion flaw.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:29 vuln.today

Patch released

Apr 21, 2026 - 14:32 nvd

Patch available

Apr 16, 2026 - 19:16 EUVD

EUVD ID Assigned

Apr 16, 2026 - 18:45 euvd

EUVD-2025-209504

CVE Published

Apr 16, 2026 - 17:59 nvd

MEDIUM 4.4

DescriptionCVE.org

Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper resource shutdown or release vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service.

AnalysisAI

Dell PowerScale OneFS prior to version 9.12.0.0 contains an improper resource shutdown or release flaw (CWE-404) that a high-privileged local attacker can exploit to cause a denial of service against the storage platform. The CVSS vector (AV:L/PR:H) confirms exploitation is constrained to authenticated local access with elevated privileges, significantly limiting the realistic attack surface. No public exploit code has been identified at time of analysis, EPSS sits at 0.01% (0th percentile), and CISA's SSVC framework rates exploitation as none and technical impact as partial, collectively indicating this is a low-urgency finding for most environments.

Technical ContextAI

Dell PowerScale OneFS is a scale-out NAS operating system that powers Dell's Isilon storage clusters, managing distributed file system resources across nodes. CWE-404 (Improper Resource Shutdown or Release) indicates that the software fails to properly release or shut down a system resource such as a file handle, network socket, lock, or memory allocation, which under specific conditions triggered by a privileged local user can exhaust available resources and result in availability loss. The affected CPE is cpe:2.3:a:dell:powerscale_onefs:*:*:*:*:*:*:*:*, spanning multiple release branches including the 9.5.x, 9.7.x, and 9.10.x lines as confirmed by EUVD version ranges. The flaw is scoped to a single system (S:U), meaning impact does not propagate to adjacent cluster nodes or dependent systems.

RemediationAI

The primary fix is to upgrade Dell PowerScale OneFS to version 9.12.0.0 or later, or to the nearest patched branch release: 9.5.1.5 or 9.10.1.3 for 9.5.x deployments, and 9.7.1.10 for 9.7.x deployments. Patch availability is confirmed by the vendor via Dell Security Advisory DSA-2025-347, available at https://www.dell.com/support/kbdoc/en-us/000376214/dsa-2025-347-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities. Where immediate patching is not feasible, restrict console and SSH access to OneFS management interfaces to only named, authorized administrators using role-based access controls and network-level ACLs, reducing the pool of users who could trigger the flaw. Given the PR:H requirement, enforcing the principle of least privilege so that fewer accounts hold elevated permissions directly reduces exposure without requiring a maintenance window.