CVE-2025-43992

Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an authentication bypass by assumed-immutable data vulnerability in Geo replication. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access to data in transit.

CVSS v3 5.6 MEDIUM

5.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000462117/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities-1	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:dell:elastic_cloud_storage::::::::
	cpe:2.3:a:dell:objectscale::::::::

History

14 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Dell ECS 3.8.1.0 a 3.8.1.7 y las versiones de Dell ObjectScale anteriores a 4.3.0.0, contienen una vulnerabilidad de omisión de autenticación por datos asumidos como inmutables en la replicación geográfica. Un atacante no autenticado con acceso remoto podría potencialmente explotar esta vulnerabilidad, lo que llevaría a un acceso no autorizado a los datos en tránsito.

Information

Published : 2026-05-11 10:16

Updated : 2026-10-14 13:10

NVD link : CVE-2025-43992

Mitre link : CVE-2025-43992

CVE.ORG link : CVE-2025-43992

JSON object : View

Products Affected

dell

objectscale
elastic_cloud_storage

CWE

CWE-302

Authentication Bypass by Assumed-Immutable Data

{"id": "CVE-2025-43992", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-43992", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T13:43:19.697984Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security_alert@emc.com", "affectedData": [{"vendor": "Dell", "product": "ECS", "versions": [{"status": "affected", "version": "0", "lessThan": "4.3.0.0 or later", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Dell", "product": "ObjectScale", "versions": [{"status": "affected", "version": "0", "lessThan": "4.3.0.0 or later", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-11T10:16:12.727", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000462117/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities-1", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-302"}]}], "descriptions": [{"lang": "en", "value": "Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an authentication bypass by assumed-immutable data vulnerability in Geo replication. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access to data in transit."}, {"lang": "es", "value": "Las versiones de Dell ECS 3.8.1.0 a 3.8.1.7 y las versiones de Dell ObjectScale anteriores a 4.3.0.0, contienen una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n por datos asumidos como inmutables en la replicaci\u00f3n geogr\u00e1fica. Un atacante no autenticado con acceso remoto podr\u00eda potencialmente explotar esta vulnerabilidad, lo que llevar\u00eda a un acceso no autorizado a los datos en tr\u00e1nsito."}], "lastModified": "2026-10-14T13:10:00.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:elastic_cloud_storage:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EDF94DDF-5A13-493A-B58C-9BBD6C3D38FD", "versionEndExcluding": "4.3.0.0", "versionStartIncluding": "3.8.1.0"}, {"criteria": "cpe:2.3:a:dell:objectscale:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06616353-B83B-49E0-A487-208D0D66FBAF", "versionEndExcluding": "4.3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}