CVE-2025-43722
📋 TL;DR
Dell PowerScale OneFS versions before 9.12.0.0 have a privilege escalation vulnerability where a high-privileged local attacker can gain additional system privileges. This affects organizations using vulnerable Dell PowerScale storage systems with local administrative access.
💻 Affected Systems
- Dell PowerScale OneFS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
A malicious insider or compromised administrator account could gain full system control, potentially accessing sensitive data, disrupting operations, or establishing persistence.
Likely Case
Privileged users exploiting the vulnerability to bypass intended access controls and perform unauthorized actions within the storage system.
If Mitigated
With proper access controls and monitoring, exploitation would be limited to authorized administrative sessions and detectable through audit logs.
🎯 Exploit Status
Exploitation requires local access and existing high privileges. No public exploit code is currently available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.12.0.0 or later
Vendor Advisory: https://www.dell.com/support/kbdoc/en-us/000363686/dsa-2025-319-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities
Restart Required: No
Instructions:
1. Review Dell advisory DSA-2025-319. 2. Upgrade PowerScale OneFS to version 9.12.0.0 or later. 3. Follow Dell's upgrade procedures for PowerScale clusters.
🔧 Temporary Workarounds
Restrict local administrative access
allLimit the number of users with local administrative privileges to only those who absolutely require it.
🧯 If You Can't Patch
- Implement strict access controls and monitor all privileged user activity
- Segment PowerScale systems from general network access and limit administrative interfaces
🔍 How to Verify
Check if Vulnerable:
Check OneFS version via SSH: 'isi version' or through PowerScale web interfaceCheck Version:
isi versionVerify Fix Applied:
Confirm version is 9.12.0.0 or later using 'isi version' command📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation attempts in audit logs
- Unexpected administrative actions from privileged accounts
Network Indicators:
- Unusual administrative access patterns to PowerScale management interfaces
SIEM Query:
source="powerscale" AND (event_type="privilege_escalation" OR user="admin" AND action="elevate")