Dell ECS and ObjectScale CVE-2025-43992

Exploitation requires: (1) the target ECS or ObjectScale deployment must be actively performing Geo replication between sites, (2) the attacker must have network access to replication traffic (AV:N does not guarantee internet-facing replication; likely requires intra-datacenter or inter-site network visibility), and (3) the attacker must be able to forge or modify authentication data in a manner accepted by the replication protocol. Authentication is not required (PR:N), but the high complexity (AC:H) suggests the attacker must satisfy specific timing, network positioning, or protocol state conditions that are not trivial to replicate. Deployments without active geo-replication may not be vulnerable, though this is not explicitly stated in the advisory; organizations with ECS/ObjectScale deployed in single-site configurations should verify replication status.

CVSS 5.6 with network vector (AV:N) and high complexity (AC:H) indicates moderate severity; the high complexity suggests exploitation requires specific conditions or timing. EPSS and KEV status are not provided, so active exploitation likelihood is unconfirmed. The vulnerability requires no authentication (PR:N) and affects confidentiality, integrity, and availability of data in transit (C:L, I:L, A:L) - all at low impact. The AC:H rating is the primary limiting factor; real-world risk depends on whether an attacker can reliably satisfy those conditions (e.g., network position, specific replication state, or traffic interception). Without KEV confirmation or POC evidence, this appears to be a moderate-priority issue for organizations running affected versions in production geo-replicated deployments, particularly those transmitting sensitive data across sites. The gap between network accessibility and high complexity suggests this is not trivially exploitable from an arbitrary internet host.

An attacker positioned on the network path between two geo-replicated ECS or ObjectScale sites observes replication traffic. The attacker intercepts and modifies authentication data (e.g., tokens or signatures) assumed immutable by the replication protocol, forging a valid peer identity. The replication service accepts the spoofed authentication and establishes a data channel, allowing the attacker to read or modify data transiting between sites. High complexity (AC:H) likely stems from the need to craft valid-appearing immutable data or trigger the vulnerability during specific replication states.