Dell Storage Manager CVE-2025-43994

Exploitation requires network reachability to the Dell Storage Manager (DSM) Data Collector / management interface, which exposes a critical function that performs no authentication check (CWE-306); against an affected build such as DSM 20.1.21, a remote attacker needs no credentials, no user interaction, and no special configuration to trigger it (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is network exposure of the management plane: DSM is typically deployed on an internal storage/management network, so risk is substantially reduced when that interface is segmented and not reachable from untrusted zones, and elevated where it is exposed to broad internal access or the internet. Impact is confined to information disclosure (C:H, I:N, A:N) - no data modification or service disruption results directly.

Multiple signals converge on a MODERATE, not top-tier, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw - attractive on paper - but the impact is scoped strictly to confidentiality (C:H/I:N/A:N), i.e. information disclosure only, with no integrity or availability impact and no scope change (S:U), consistent with the CWE-306 Missing Authentication classification. EPSS is low at 0.60% (47th percentile), indicating the predictive models do not expect near-term mass exploitation, and the CVE is NOT on CISA KEV with no public POC identified, so there is no evidence of active or at-scale exploitation. These signals are internally consistent rather than conflicting: an easily-reachable unauthenticated bug that nonetheless scores only 7.5 because it leaks data rather than granting code execution or control. The main caveat is informational: the Dell advisory (DSA-2025-393) was not fetched in this analysis, so the exact nature of the disclosed information (credentials, configuration, SAN topology, or less sensitive data) is unconfirmed - if the leaked data includes credentials or tokens enabling follow-on access, real-world risk would be higher than the standalone C:H suggests. Treat as a prioritized patch for internet- or management-network-exposed instances, but not an emergency absent evidence the disclosure chains into fuller compromise.

An attacker with network access to the Dell Storage Manager management interface sends a request to a critical function that fails to enforce authentication, retrieving sensitive information without any credentials or user interaction. Because CVSS indicates AV:N/AC:L/PR:N/UI:N, no special timing or victim action is required, though the attacker must first be able to reach the management endpoint. No public exploit code was identified at time of analysis.