Dell Storage Manager CVE-2025-43995

Exploitation requires network reachability to the Dell Storage Manager DSM Data Collector component (the ApiProxy.war application inside DataCollectorEar.ear) and use of a specific built-in special SessionKey together with a special UserId corresponding to service accounts created in compellentservicesapi. No user authentication, user interaction, or non-default configuration is needed - the special-user session path is a native part of the Data Collector. The practical limiting factor is knowledge of the special SessionKey/UserId values; once those are disclosed or extracted, exploitation is unauthenticated and automatable against version 20.1.21. Risk is further bounded by whether the Data Collector management interface is exposed to untrusted networks versus segmented on a management VLAN.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is internally consistent with the description: a remote, unauthenticated attacker bypasses authentication on the DSM Data Collector by presenting a 'special SessionKey' and 'UserId' tied to service accounts in compellentservicesapi, gaining access to APIs exposed by ApiProxy.war. CWE-287 (Improper Authentication) correctly matches the described flaw. EPSS is 0.84% (56th percentile) - moderate, not alarming - which reflects that no public exploit has surfaced yet rather than low exploitability; the bug itself is trivially automatable once the special SessionKey/UserId values are known or reverse-engineered from the DataCollectorEar.ear artifacts. The CVE is NOT in CISA KEV and there is no evidence of active exploitation. SSVC parameters were not provided in the input. The signals are consistent (network-reachable, no privileges, full CIA impact against a storage-array management plane), so the main gating factor is knowledge of the built-in credential/session values, not an exploitation barrier once disclosed.

An attacker who can reach the Dell Storage Manager Data Collector over the network sends API requests to endpoints served by ApiProxy.war, supplying one of the built-in special SessionKey and UserId values associated with the compellentservicesapi service accounts. Because the Data Collector accepts these special credentials without genuine authentication, the attacker gains unauthorized access to management APIs and the storage environment they control. No public exploit code has been identified at time of analysis, but the flaw is deterministic and easily automated once the special values are known.