Dell Technologies has released a critical security advisory (DSA-2025-119) addressing multiple vulnerabilities in Dell PowerScale OneFS that could potentially be exploited by malicious actors to compromise affected systems.
The most severe vulnerability has received a CVSS base score of 9.8, indicating critical risk that requires immediate attention from system administrators.
Critical Vulnerabilities Impact Dell PowerScale OneFS
The security update addresses six vulnerabilities of varying severity levels affecting PowerScale OneFS versions 9.4.0.0 through 9.10.1.0.
The most concerning issue, CVE-2025-27690, involves the use of a default password vulnerability that could allow an unauthenticated attacker with remote access to take over a high-privileged user account.
This vulnerability affects versions 9.5.0.0 through 9.10.1.0 and has received the highest severity rating among the identified issues.
Another significant vulnerability, CVE-2025-26330, contains an incorrect authorization flaw that could allow an unauthenticated attacker with local access to access the cluster with the previous privileges of a disabled user account.
This vulnerability has received a CVSS score of 7.0, categorizing it as high risk.
The remaining vulnerabilities include an integer overflow (CVE-2025-22471), an uncontrolled resource consumption vulnerability (CVE-2025-26480), an information disclosure through directory listing (CVE-2025-23378), and an out-of-bounds write vulnerability (CVE-2025-26479).
These issues have CVSS scores ranging from 3.1 to 6.5, representing medium to low risk levels.
| CVE ID | Description | CVSS Base Score | Risk Level |
|---|---|---|---|
| CVE-2025-27690 | Use of default password vulnerability | 9.8 | Critical |
| CVE-2025-26330 | Incorrect authorization vulnerability | 7.0 | High |
| CVE-2025-22471 | Integer overflow or wraparound vulnerability | 6.5 | Medium |
| CVE-2025-26480 | Uncontrolled resource consumption vulnerability | 5.3 | Medium |
| CVE-2025-23378 | Exposure of information through directory listing | 3.3 | Low |
| CVE-2025-26479 | Out-of-bounds write vulnerability | 3.1 | Low |
Remediation Options and Workarounds
Dell has released remediated versions to address these vulnerabilities.
The company recommends that all customers upgrade to version 9.10.1.1 or later to address most of the identified issues.
For specific version ranges, Dell has provided targeted update paths – for example, versions 9.4.0.0 through 9.4.0.20 should update to version 9.4.0.21 or later to address CVE-2025-22471.
For organizations unable to immediately update their systems, Dell has provided several workarounds specifically for the critical CVE-2025-27690 vulnerability.
These include:
- Adding impacted users to the “Users who cannot be modified” list using the command
isi auth file modify Systemwith appropriate parameters - Setting or resetting passwords for users not blocked for modification in the System zone file provider
- Disabling the WebUI and API via CLI using
isi http services modify Platform-API-External --enabled=false - Limiting access to API and WebUI to trusted networks via firewall rules
Dell encourages all customers to adopt the Long-Term Support (LTS) 2025 version, which is the 9.10.1.x code line, with the latest maintenance release (currently MR 9.10.1.1).
The advisory was initially released on April 7, 2025, with minor updates on April 9, 2025, to remove a duplicate entry.
System administrators are advised to assess the applicability of these vulnerabilities to their environment and take appropriate actions to protect their systems.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates
%20(1).webp?fit=1600,900&ssl=1&description=The most severe vulnerability has received a CVSS base score of 9.8, indicating critical risk that requires immediate attention from system administrators.){kind=link}