CVE-2025-36572 Overview
Dell PowerStore version 4.0.0.0 contains a hard-coded credentials vulnerability [CWE-798] within the PowerStore image file. The flaw allows a low-privileged remote attacker who knows the embedded credentials to authenticate and gain unauthorized access. Access rights are constrained to the privileges of the hard-coded account, which enables confidentiality impact on the affected storage appliance.
Dell issued advisory DSA-2025-223 covering this and other PowerStore T-series vulnerabilities. The issue affects the PowerStoreOS software running on multiple T-series and Q-series storage array models, from PowerStore 500T through PowerStore 9200T.
Critical Impact
An attacker with network reachability and knowledge of the embedded credentials can authenticate to affected PowerStore appliances and access data within the scope of the hardcoded account.
Affected Products
- Dell PowerStoreOS 4.0.0.0
- Dell PowerStore 500T, 1000T, 1200T, 3000T, 3200T, 3200Q
- Dell PowerStore 5000T, 5200T, 7000T, 9000T, 9200T
Discovery Timeline
- 2025-05-28 - CVE-2025-36572 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-36572
Vulnerability Analysis
The vulnerability stems from hard-coded credentials embedded inside the PowerStore image file distributed with PowerStoreOS 4.0.0.0. Hard-coded credentials [CWE-798] persist in shipped software and cannot be removed or rotated through normal administrative controls. Any party that recovers the credentials from the image can authenticate as the embedded account against exposed PowerStore management interfaces.
The attack requires network access and low-level existing privileges. It does not require user interaction. Successful exploitation impacts confidentiality on the target appliance but does not alter integrity or availability according to the published CVSS vector. The scope of access matches whatever the hardcoded account is authorized to perform on the PowerStore control plane.
Root Cause
Credentials were embedded directly in the PowerStore image file rather than provisioned per-deployment or derived from customer-managed secrets. Because every appliance running the affected build ships with the same credential material, disclosure of the secret from one image compromises every device on that release.
Attack Vector
An attacker reaches an exposed PowerStore management service over the network and authenticates using the recovered credentials. From that session, the attacker exercises the privileges of the hardcoded account to access data or configuration surfaces available to that account. No exploit code is publicly available and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.
The vulnerability manifests inside the shipped PowerStore image. See the Dell Security Update DSA-2025-223 for vendor-provided technical detail and fixed versions.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-36572
Indicators of Compromise
- Authentication events on PowerStore management interfaces from unexpected source addresses or outside change windows.
- Sessions established as service or maintenance accounts that are not tied to a known administrator.
- Configuration reads or exports on PowerStore arrays that do not correlate with scheduled operations.
Detection Strategies
- Inventory all PowerStore T-series and Q-series arrays and identify any running PowerStoreOS 4.0.0.0.
- Forward PowerStore audit and authentication logs to a central SIEM and alert on logins from non-administrative networks.
- Baseline normal management-plane behavior and flag deviations in account usage, source IPs, and API call patterns.
Monitoring Recommendations
- Continuously monitor management interface exposure and confirm that PowerStore control-plane ports are not reachable from untrusted networks.
- Track patch state of PowerStoreOS across the fleet and alert when appliances drift back to affected builds.
- Correlate storage-array authentication telemetry with broader identity events to detect credential reuse against other systems.
How to Mitigate CVE-2025-36572
Immediate Actions Required
- Apply the PowerStoreOS update referenced in Dell advisory DSA-2025-223 to all affected appliances.
- Restrict network access to PowerStore management interfaces to dedicated administrative networks and jump hosts.
- Review recent authentication and audit logs on PowerStore arrays for use of non-standard or service accounts.
Patch Information
Dell has published fixed PowerStoreOS versions and remediation guidance in Dell Security Update DSA-2025-223. Upgrade all PowerStore 500T, 1000T, 1200T, 3000T, 3200T, 3200Q, 5000T, 5200T, 7000T, 9000T, and 9200T appliances running PowerStoreOS 4.0.0.0 to the vendor-specified fixed release.
Workarounds
- Place PowerStore management interfaces behind network access controls that permit only trusted administrative sources until patching completes.
- Enforce strict segmentation between storage management VLANs and general user or server networks.
- Increase logging verbosity on the management plane and alert on any authentication that does not originate from approved administrative hosts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
