Dell PowerScale OneFS up to 9.11.0.0 NFSv4/SMB authorization

Summaryinfo

A vulnerability categorized as problematic has been discovered in Dell PowerScale OneFS. Affected by this issue is some unknown functionality of the component NFSv4/SMB. The manipulation results in authorization. This vulnerability is identified as CVE-2025-43724. The attack is only possible with local access. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Dell PowerScale OneFS. Affected is an unknown functionality of the component NFSv4/SMB. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. This is going to have an impact on availability. CVE summarizes:

Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an authorization bypass through user-controlled key vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to gain unauthorized access to NFSv4 or SMB shares.

The advisory is shared for download at dell.com. This vulnerability is traded as CVE-2025-43724 since 04/17/2025. The exploitability is told to be easy. The attack needs to be approached locally. The exploitation needs additional levels of successful authentication. There are neither technical details nor an exploit publicly available.

Upgrading to version 9.12.0.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Dell

Name

• PowerScale OneFS

Version

• 8.1.0
• 8.1.2
• 8.2
• 8.2.2
• 9.0.0
• 9.1.0
• 9.2.0
• 9.2.1
• 9.2.1.12
• 9.2.1.13
• 9.3.0
• 9.3.0.5
• 9.3.0.6
• 9.4
• 9.4.0
• 9.4.0.2
• 9.4.0.3
• 9.4.0.16
• 9.4.0.17
• 9.5
• 9.5.0
• 9.5.0.0
• 9.5.0.5
• 9.5.0.6
• 9.5.0.7
• 9.5.0.8
• 9.5.1.0
• 9.5.1.1
• 9.5.1.2
• 9.5.1.4
• 9.6.1.0
• 9.7.0.0
• 9.7.0.1
• 9.7.0.2
• 9.7.0.3
• 9.7.1.2
• 9.7.1.4
• 9.7.1.6
• 9.7.1.10
• 9.8.0.0
• 9.8.0.2
• 9.9.0.0
• 9.9.0.1
• 9.10.0.0
• 9.10.0.1
• 9.10.1.0
• 9.10.1.3
• 9.11.0.0

License

• commercial

Website

• Vendor: https://www.dell.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion