Dell Storage Manager CVE-2025-46425

Exploitation requires network reachability to the Dell Storage Manager 20.1.20 management interface AND valid low-privileged account credentials (CVSS PR:L) - it is NOT unauthenticated. The attacker must be able to submit XML input to a component that parses external entity references (CWE-611). No user interaction is required (UI:N). The authentication requirement is the primary limiting factor, confining realistic exploitation to users who already have some level of access or to post-credential-compromise scenarios; impact is limited to unauthorized data access (C:H) with no integrity or availability effect.

This is a moderate-severity, moderate-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable XXE that a low-privileged authenticated user can trigger with low complexity and no user interaction, yielding high confidentiality impact but no integrity or availability impact - consistent with XXE used to read files or reach internal resources. The EPSS score is low at 0.33% (24th percentile), the vulnerability is NOT in CISA KEV, and no public proof-of-concept is referenced, so all three exploitation-pressure signals agree that active or imminent mass exploitation is unlikely. The signals are therefore internally consistent (no CVSS-vs-EPSS conflict): a genuine but not urgent flaw. The principal gating factor is the PR:L requirement - an attacker must already hold valid low-privilege credentials to the Storage Manager interface, which meaningfully narrows the opportunistic threat surface and pushes this toward insider or post-compromise risk rather than drive-by exploitation. No SSVC decision data was supplied in the input, so automatable/technical-impact classification cannot be stated.

An attacker holding low-privileged credentials to a Dell Storage Manager 20.1.20 instance submits a crafted XML payload containing an external entity reference to an endpoint that parses XML without disabling external entities. The parser resolves the entity, allowing the attacker to read local files or reach internal systems and obtain unauthorized access to sensitive data. No public exploit code is identified at time of analysis, and exploitation requires valid authentication.