CVE-2025-36601

Dell PowerScale OneFS, versions 9.5.0.0 through 9.11.0.0, contains an exposure of sensitive information to an unauthorized actor vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to Information disclosure.

CVSS v3 4.0 MEDIUM

4.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000353080/dsa-2025-272-security-update-for-dell-powerscale-onefs-multiple-third-party-component-vulnerabilities	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:dell:powerscale_onefs::::::::
	cpe:2.3:o:dell:powerscale_onefs::::::::
	cpe:2.3:o:dell:powerscale_onefs::::::::
	cpe:2.3:o:dell:powerscale_onefs:9.11.0.0:::::::*

History

11 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Dell PowerScale OneFS, versiones 9.5.0.0 a 9.11.0.0, contiene una vulnerabilidad de exposición de información sensible a un actor no autorizado. Un atacante remoto no autenticado podría potencialmente explotar esta vulnerabilidad, lo que llevaría a la revelación de información.

Information

Published : 2025-09-25 15:16

Updated : 2026-10-11 20:10

NVD link : CVE-2025-36601

Mitre link : CVE-2025-36601

CVE.ORG link : CVE-2025-36601

JSON object : View

Products Affected

dell

powerscale_onefs

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo

{"id": "CVE-2025-36601", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-36601", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-25T15:44:09.689055Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security_alert@emc.com", "affectedData": [{"vendor": "Dell", "product": "PowerScale OneFS", "versions": [{"status": "affected", "version": "9.5.0.0", "lessThan": "9.5.1.4", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2025-09-25T15:16:10.890", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000353080/dsa-2025-272-security-update-for-dell-powerscale-onefs-multiple-third-party-component-vulnerabilities", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Dell PowerScale OneFS, versions 9.5.0.0 through 9.11.0.0, contains an exposure of sensitive information to an unauthorized actor vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to Information disclosure."}, {"lang": "es", "value": "Dell PowerScale OneFS, versiones 9.5.0.0 a 9.11.0.0, contiene una vulnerabilidad de exposici\u00f3n de informaci\u00f3n sensible a un actor no autorizado. Un atacante remoto no autenticado podr\u00eda potencialmente explotar esta vulnerabilidad, lo que llevar\u00eda a la revelaci\u00f3n de informaci\u00f3n."}], "lastModified": "2026-10-11T20:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:powerscale_onefs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1540CAF7-15B6-46DF-BA82-20B544E43CFB", "versionEndExcluding": "9.10.1.3", "versionStartIncluding": "9.8.0.0"}, {"criteria": "cpe:2.3:o:dell:powerscale_onefs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63EE5B28-1B70-497E-87B5-1727713DD424", "versionEndExcluding": "9.5.1.4", "versionStartIncluding": "9.5.0.0"}, {"criteria": "cpe:2.3:o:dell:powerscale_onefs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A1BAD8C5-8AC7-4AF3-A2DB-C7E4B249514B", "versionEndExcluding": "9.7.1.10", "versionStartIncluding": "9.6.0"}, {"criteria": "cpe:2.3:o:dell:powerscale_onefs:9.11.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A021C3E4-844E-4728-8887-BDEBEA54235C"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}