Dell PowerScale OneFS CVE-2025-43937

Exploitation requires three concurrent conditions: (1) an existing low-privileged local account on the PowerScale OneFS cluster node - remote or unauthenticated attackers cannot exploit this per AV:L/PR:L; (2) the ability to trigger the specific authentication or error-handling code path that causes credential data to be written to the log, which UI:R indicates involves some form of user interaction or a specific triggerable event rather than passive observation; and (3) read access to the log files where the credential data is captured. Exploitation is further limited to Dell PowerScale OneFS versions prior to 9.12.0.0 (or the respective unpatched branch versions: pre-9.5.1.5, pre-9.10.1.3, pre-9.7.1.9). Remote attackers, unauthenticated users, and users without local shell access to cluster nodes are not affected. The specific log paths and triggerable events are not disclosed in publicly available data.

Real-world risk is moderate and meaningfully constrained by multiple gatekeeping factors. The CVSS AV:L metric requires the attacker to already possess local shell access to a cluster node, eliminating remote and unauthenticated threat actors entirely. PR:L confirms an existing authenticated account is required, and UI:R signals that a triggerable interactive event - not passive observation - must occur to produce the vulnerable log entry. EPSS at 0.01% (2nd percentile) reflects near-zero observed exploitation probability, and SSVC rates exploitation as none with only partial technical impact, consistent with an opportunistic post-breach escalation path rather than a primary attack vector. Notably, the vendor-supplied CVSS vector includes A:H (high availability impact), which is unexplained by the vulnerability description of credential disclosure into logs - this discrepancy should be independently verified against Dell advisory DSA-2025-347, as the A:H may reference a separate co-bundled issue. If the logged credentials belong to a highly privileged or administrative account, the downstream impact of successful exploitation could be significant. The overall risk profile is medium: constrained initial access requirements limit exposure, but the post-breach escalation potential is real if monitoring of local user activity is insufficient.

A low-privileged operator or developer holding a standard local shell account on a Dell PowerScale OneFS cluster triggers an authentication event - such as a login attempt, session renewal, or error condition - that causes another user's credentials to be written to a system log file. The attacker then reads the log, extracts recoverable credential material for a more privileged account, and authenticates as that user to access sensitive file shares or cluster administrative interfaces. No public exploit code has been identified at time of analysis.