What is the CVSS score of CVE-2025-43992?

CVE-2025-43992 has a CVSS 3.1 base score of 5.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2025-43992?

Yes, a patch is available for CVE-2025-43992. Update the affected software to the latest version immediately.

Dell ECS and ObjectScale CVE-2025-43992

EUVD-2025-209757 MEDIUM

Authentication Bypass by Assumed-Immutable Data (CWE-302)

2026-05-11 dell

GHSA-g6xr-2p64-fh4g

Dell Authentication Bypass

5.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.6 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

May 11, 2026 - 11:01 EUVD

Analysis Generated

May 11, 2026 - 10:31 vuln.today

CVE Published

May 11, 2026 - 09:27 nvd

MEDIUM 5.6

DescriptionCVE.org

Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an authentication bypass by assumed-immutable data vulnerability in Geo replication. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access to data in transit.

AnalysisAI

Authentication bypass in Dell ECS Geo replication (versions 3.8.1.0-3.8.1.7) and Dell ObjectScale (prior to 4.3.0.0) allows unauthenticated remote attackers to access data in transit by exploiting assumed-immutable data assumptions. The vulnerability affects the replication authentication mechanism, enabling unauthorized data exposure without requiring valid credentials or user interaction.

Technical ContextAI

Dell ECS (Elastic Cloud Storage) and ObjectScale are object storage platforms that implement Geo replication for data redundancy across geographic sites. The vulnerability resides in the Geo replication authentication logic, which relies on data that should be cryptographically bound or immutable (likely tokens, signatures, or session identifiers per CWE-302: Authentication Using Assumed-Immutable Data). An attacker can forge or tamper with authentication credentials by modifying data assumed to be immutable, circumventing the replication handshake. The affected CPE strings indicate all versions of ECS 3.8.1.0 through 3.8.1.7 and all ObjectScale versions before 4.3.0.0 are vulnerable.

RemediationAI

For Dell ECS, upgrade to the first patched version following 3.8.1.7; consult Dell DSA-2026-047 for exact patched version availability. For Dell ObjectScale, upgrade to version 4.3.0.0 or later. If immediate patching is not feasible, implement network segmentation to restrict Geo replication traffic to trusted, authenticated peers only - use firewall rules or VPN tunnels to control replication endpoints and prevent unauthorized data-in-transit access. Additionally, monitor replication authentication logs for anomalous handshake failures or unexpected peer connections. These compensating controls reduce exposure but do not eliminate the underlying vulnerability; patching remains the definitive remediation. Verify patch application with vendor documentation and perform regression testing on replication functionality before full deployment.