DSA-2025-191: Security Update for Storage Center - Dell Storage Manager Vulnerabilities

Resumen: Storage Center - Dell Storage Manager remediation is available for DSM that could be exploited by malicious users to compromise the affected system.

Este artículo se aplica a Este artículo no se aplica a Este artículo no está vinculado a ningún producto específico. No se identifican todas las versiones del producto en este artículo.
Consulte estos recursos

Impacto

High

Detalles

Third-party Component CVEs More Information
OpenSSH CVE-2023-48795 https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.
jszip CVE-2022-48285, CVE-2021-23413 https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.
JQuery CVE-2020-11022, CVE-2020-11023, CVE-2015-9251 https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.
AngularJS CVE-2020-7676 https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

 

Proprietary Code CVEs Description CVSS Base Score CVSS Vector String
CVE-2025-22479 Dell Storage Center - Dell Storage Manager, version(s) 20.0.21, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection. 3.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NThis hyperlink is taking you to a website outside of Dell Technologies.
CVE-2025-22477 Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Elevation of privileges. 8.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LThis hyperlink is taking you to a website outside of Dell Technologies.
CVE-2025-22478 Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Information tampering. 8.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NThis hyperlink is taking you to a website outside of Dell Technologies.
CVE-2025-22476 Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote execution. 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LThis hyperlink is taking you to a website outside of Dell Technologies.
CVE-2025-23379 Dell Storage Center - Dell Storage Manager, version(s) 21.0.20, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection. 3.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NThis hyperlink is taking you to a website outside of Dell Technologies.

 

Proprietary Code CVEs Description CVSS Base Score CVSS Vector String
CVE-2025-22479 Dell Storage Center - Dell Storage Manager, version(s) 20.0.21, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection. 3.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NThis hyperlink is taking you to a website outside of Dell Technologies.
CVE-2025-22477 Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Elevation of privileges. 8.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LThis hyperlink is taking you to a website outside of Dell Technologies.
CVE-2025-22478 Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Information tampering. 8.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NThis hyperlink is taking you to a website outside of Dell Technologies.
CVE-2025-22476 Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote execution. 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LThis hyperlink is taking you to a website outside of Dell Technologies.
CVE-2025-23379 Dell Storage Center - Dell Storage Manager, version(s) 21.0.20, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection. 3.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NThis hyperlink is taking you to a website outside of Dell Technologies.

 

Dell Technologies recomienda que todos los clientes tengan en cuenta tanto la puntuación base como cualquier otra puntuación ambiental y temporal relevante que pueda afectar la posible gravedad asociada con la vulnerabilidad de seguridad en particular.

Corrección y productos afectados

Product Software/Firmware Affected Versions Remediated Versions Link
Dell Storage Manager DSM Versions prior to 2020 R1.21 Version 2020 R1.21 or later https://www.dell.com/support/product-details/product/storage-scv3000/drivers

 

Product Software/Firmware Affected Versions Remediated Versions Link
Dell Storage Manager DSM Versions prior to 2020 R1.21 Version 2020 R1.21 or later https://www.dell.com/support/product-details/product/storage-scv3000/drivers

 

Soluciones alternativas y mitigaciones

CVE ID Workaround and Mitigation
CVE-2023-48795 Remove vulnerable ChaCha20-Poly1305 cipher from SSH configuration

 

Historial de revisiones

RevisionDateDescription
1.02025-05-05Initial Release
2.02025-05-06Adding acknowledgements
3.02025-05-06Corrected minor spelling mistakes.
4.02026-02-25Updating the category section to add Compellent arrays

 

Reconocimientos

CVE-2025-23379, CVE-2025-22479: Dell would like to thank redfr0g for reporting this issue.

CVE-2025-22477, CVE-2025-22478: Dell would like to thank sradulea for reporting this issue.

CVE-2025-22476: Dell would like to thank sradulea and xiaohei from Ubisectech Sirius Team for reporting this issue.

Información relacionada

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide

Descargo de responsabilidad

Productos afectados

FS Series, SC Series, Dell Compellent FS8600, Dell Compellent SC200, Dell Compellent SC220, Dell Compellent SC280, Dell Compellent SC4020, Dell Compellent Series 40, Dell Storage Manager
Propiedades del artículo
Número del artículo: 000317318
Tipo de artículo: Dell Security Advisory
Última modificación: 25 feb 2026
Encuentre respuestas a sus preguntas de otros usuarios de Dell
Servicios de soporte
Compruebe si el dispositivo está cubierto por los servicios de soporte.