CVE-2025-46425: Dell Storage Manager XXE Vulnerability

CVE-2025-46425 Overview

CVE-2025-46425 is an XML External Entity (XXE) vulnerability [CWE-611] in Dell Storage Center - Dell Storage Manager version 20.1.20. The flaw exists in the improper restriction of XML external entity references during XML processing. An authenticated attacker with low privileges and network access can exploit this vulnerability to gain unauthorized access to data on the affected system.

Dell published advisory DSA-2025-393 addressing the issue. The National Vulnerability Database (NVD) published the record on October 24, 2025.

Critical Impact
A low-privileged remote attacker can leverage crafted XML input to read sensitive files or internal resources accessible to the Storage Manager service, resulting in unauthorized data disclosure.

Affected Products

Dell Storage Manager 20.1.20
Dell Storage Manager 2020 R1, R1.2, R1.10, R1.20
Dell Storage Center management components bundled with the above releases

Discovery Timeline

2025-10-24 - CVE-2025-46425 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46425

Vulnerability Analysis

Dell Storage Manager processes XML documents without adequately restricting external entity references. When the XML parser encounters a document type definition (DTD) that declares an external entity, it resolves the reference and includes the retrieved content in the parsed output. This behavior allows an attacker to instruct the parser to fetch arbitrary local files or internal network resources.

The vulnerability requires authentication but only low privileges. The impact is limited to confidentiality; the advisory does not indicate integrity or availability effects. Attackers commonly abuse XXE conditions to retrieve configuration files, credentials, or internal API responses reachable from the server.

Root Cause

The root cause is improper restriction of XML external entity references [CWE-611]. The XML parser used by Storage Manager does not disable external entity resolution or DTD processing. Secure defaults such as disabling DOCTYPE declarations, external general entities, and external parameter entities are absent in the vulnerable code path.

Attack Vector

An attacker authenticated to Storage Manager submits an HTTP request containing an XML payload that declares an external entity pointing to a local file URI or an internal network resource. The server-side parser dereferences the entity during processing and returns the fetched content in a response, error message, or downstream operation. The attacker harvests the disclosed data to enumerate the environment or pivot into further attacks.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-46425

Indicators of Compromise

Inbound HTTP requests to Storage Manager endpoints containing <!DOCTYPE, <!ENTITY, or SYSTEM declarations in XML request bodies
Outbound connections from the Storage Manager host to unexpected internal IP addresses, DNS resolvers, or file:// URI handlers
Unusual read access to sensitive files such as /etc/passwd, Java keystores, or Storage Manager configuration files by the service account
Storage Manager application logs showing XML parsing errors that reference external DTDs or unresolved entities

Detection Strategies

Inspect HTTP request bodies destined for Storage Manager management interfaces for XML entity declarations and DOCTYPE nodes
Correlate authenticated Storage Manager sessions with unexpected outbound traffic originating from the management service
Baseline normal XML request patterns and alert on payloads that include external system identifiers or nested entity expansion

Monitoring Recommendations

Forward Dell Storage Manager application, access, and audit logs to a centralized SIEM for retention and correlation
Monitor the Storage Manager host for file reads outside the application working directory by the service account
Alert on egress traffic from storage management VLANs to arbitrary destinations, especially DNS queries containing exfiltrated data

How to Mitigate CVE-2025-46425

Immediate Actions Required

Apply the fixed release referenced in Dell advisory DSA-2025-393 to all Storage Manager installations running 20.1.20 or earlier
Restrict network access to Storage Manager management interfaces to trusted administrative subnets and jump hosts only
Rotate credentials that may have been exposed through configuration files readable by the Storage Manager service account
Review authentication logs for suspicious low-privilege account activity preceding the patch

Patch Information

Dell has published fixed versions of Storage Manager. Refer to the Dell Security Update DSA-2025-393 for exact fixed versions, download links, and upgrade instructions.

Workarounds

Limit Storage Manager account provisioning to administrators who require access, reducing the pool of low-privilege accounts that could exploit the flaw
Place a web application firewall in front of Storage Manager to filter XML payloads containing DOCTYPE and ENTITY declarations
Segment the storage management network from general user networks to reduce lateral reach if data disclosure occurs

bash

# Example WAF rule to block XML external entity payloads (ModSecurity syntax)
SecRule REQUEST_HEADERS:Content-Type "@rx (?i)(application|text)/xml" \
    "id:1004625,phase:2,deny,status:403,log,msg:'Possible XXE payload',\
    chain"
  SecRule REQUEST_BODY "@rx (?i)(<!DOCTYPE|<!ENTITY|SYSTEM\s+[\"'])" \
    "t:none"