CVE-2025-30477
📋 TL;DR
Dell PowerScale OneFS versions before 9.11.0.0 use broken or risky cryptographic algorithms, allowing high-privileged remote attackers to potentially decrypt sensitive information. This affects organizations running vulnerable versions of Dell's scale-out NAS storage solution.
💻 Affected Systems
- Dell PowerScale OneFS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
High-privileged attacker decrypts sensitive stored data including credentials, configuration files, or encrypted communications.
Likely Case
Information disclosure of less critical encrypted data due to the need for high privileges and specific targeting.
If Mitigated
Minimal impact with proper network segmentation and privileged access controls limiting attack surface.
🎯 Exploit Status
Requires high-privileged attacker with remote access. Specific cryptographic algorithm weaknesses not detailed in public advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.11.0.0 or later
Vendor Advisory: https://www.dell.com/support/kbdoc/en-us/000317419/dsa-2025-192-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
Restart Required: Yes
Instructions:
1. Review Dell advisory DSA-2025-192. 2. Upgrade to OneFS version 9.11.0.0 or later. 3. Follow Dell's upgrade procedures for PowerScale clusters. 4. Reboot systems as required by the update.
🔧 Temporary Workarounds
Restrict administrative access
allLimit high-privileged remote access to PowerScale systems to only necessary personnel and systems.
Network segmentation
allIsolate PowerScale management interfaces from untrusted networks and implement strict firewall rules.
🧯 If You Can't Patch
- Implement strict access controls limiting administrative access to PowerScale systems
- Monitor for unusual administrative activity or cryptographic-related errors in logs
🔍 How to Verify
Check if Vulnerable:
Check OneFS version via CLI: 'isi version' or web UI. If version is below 9.11.0.0, system is vulnerable.Check Version:
isi versionVerify Fix Applied:
After upgrade, verify version is 9.11.0.0 or higher using 'isi version' command.📡 Detection & Monitoring
Log Indicators:
- Unusual administrative login patterns
- Cryptographic operation failures or warnings
Network Indicators:
- Unexpected connections to PowerScale management ports (typically 8080, 9090)
SIEM Query:
source="powerscale" AND (event_type="admin_login" OR event_type="crypto_error")