Container Storage Modules CVE-2026-54472

Requires running Dell Container Storage Modules at a version prior to 1.18.0 with the csm-docs component network-reachable by the attacker; exploitation uses credentials hard-coded in that component (CWE-798), so no user interaction and no legitimate authentication are needed per the CVSS vector (PR:N/UI:N). Limiting factors: the attacker must have network path to the affected CSM service and must know the embedded credentials; impact is confined to information disclosure (C:H, I:N, A:N) with no integrity or availability effect, and upgrading to 1.18.0 fully remediates. No active exploitation is reported (SSVC Exploitation: none, not in CISA KEV).

Signals are moderately consistent but point to a prioritize-but-not-emergency posture. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5 HIGH) describes a remotely reachable, low-complexity, unauthenticated flaw with high confidentiality impact only - matching the Use of Hard-coded Credentials (CWE-798) and Information Disclosure description. CISA SSVC reinforces concern on two axes (Automatable: yes, Technical Impact: total) but explicitly rates Exploitation: none, i.e. no observed exploitation. This aligns with the low EPSS score (0.54%, 44th percentile), the absence of a CISA KEV listing, and no indication of public POC code - so despite a HIGH CVSS this is not currently an actively-exploited priority. CONFLICT TO VERIFY: the free-text Description ends with a stray '9.8' while the structured CVSS Score and vector both yield 7.5; a 9.8 would require I:H/A:H, which contradicts the stated information-disclosure-only impact (I:N/A:N) - treat 7.5 as authoritative and verify the 9.8 against the Dell advisory. The 'Automatable: yes' plus unauthenticated network access means that IF exploit details surface, scaling would be trivial, so patching to 1.18.0 should not be deferred.

A remote, unauthenticated attacker who learns the hard-coded credentials embedded in the csm-docs component of Dell Container Storage Modules (e.g. from published documentation, source, or reverse engineering) connects to an exposed CSM instance running a version prior to 1.18.0 and uses those static credentials to read sensitive information. No public exploit code has been identified at time of analysis, but the low attack complexity and lack of required authentication make reliable exploitation straightforward once the credentials are known.