Critical Dell PowerScale OneFS Vulnerability: Default Password Exposes High-Privileged Accounts

 Understanding CVE-2025-27690: A Critical Security Threat

Dell Technologies has recently issued an urgent security advisory for a critical vulnerability in their PowerScale OneFS operating system. The vulnerability, identified as CVE-2025-27690, has been assigned the highest severity rating with a CVSS base score of 9.8 (Critical). This alarming security flaw poses a significant risk to organizations using affected Dell storage systems.

At its core, this vulnerability is a “use of default password” issue affecting Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.0. The most concerning aspect is that it allows an unauthenticated attacker with remote access to potentially take over a high-privileged user account. Security professionals should take immediate action as this vulnerability requires minimal effort to exploit and can lead to complete system compromise.

  Affected Systems and Versions

The vulnerability affects Dell PowerScale OneFS in the following versions:

• 9.5.0.0 through 9.5.1.2
• 9.7.1.0 through 9.7.1.6
• 9.8.0.0 through 9.8.0.2
• 9.9.0.0 through 9.9.0.1
• 9.10.0.0 through 9.10.1.0

Organizations running any of these versions should consider their systems at high risk until remediation steps are taken.

  How the Vulnerability Is Exploited

The exploitation path is straightforward and concerning:

1. A remote attacker targets an exposed PowerScale OneFS management interface
2. The attacker exploits CVE-2025-27690 to gain access to high-privileged accounts
3. The attacker gains system-level control of the storage infrastructure

The attack can be launched remotely and does not require any form of authentication, making it particularly dangerous.

  Remediation Steps

Dell has provided several options to mitigate this vulnerability:

1. System Upgrade (Recommended)

Dell strongly recommends upgrading to remediated versions. For this critical vulnerability, upgrading to version 9.10.1.1 or later provides protection. Dell encourages all customers to adopt the Long-Term Support (LTS) 2025 version, which is the 9.10.1.x code line, with the latest maintenance release (currently 9.10.1.1).

2. Temporary Workarounds

If immediate upgrading is not possible, Dell has provided several workarounds:

• Add impacted users to the “Users who cannot be modified” list using the command: isi auth file modify System
• Set/reset passwords for users not blocked for modification in the System zone file provider
• Disable the WebUI and API via CLI: isi http services modify Platform-API-External --enabled=false
• Implement firewall rules to limit access to API & WebUI from trusted networks

  Additional Security Context

It’s worth noting that this default password vulnerability is part of a larger set of security issues recently disclosed for PowerScale OneFS. These include incorrect authorization protocols (CVE-2025-26330), integer overflow (CVE-2025-22471), uncontrolled resource consumption (CVE-2025-26480), and other vulnerabilities that could impact system confidentiality, integrity, and availability.

 How CinchOps Can Help Secure Your Environment

In light of these critical vulnerabilities, organizations need robust security partners more than ever. CinchOps can help secure your environment through:

1. Vulnerability Assessment: Our team can scan your Dell PowerScale infrastructure to identify affected systems and prioritize remediation efforts.
2. Patch Management: We can assist with planning and implementing secure upgrade paths to remediated versions while minimizing downtime.
3. Security Hardening: Beyond patching, we implement defense-in-depth strategies including network segmentation, access controls, and continuous monitoring.
4. Emergency Response: For organizations concerned about potential exploitation, our incident response team can investigate and mitigate threats.
5. Ongoing Protection: We provide continuous vulnerability management to keep your systems protected against emerging threats.

Don’t let default password vulnerabilities compromise your critical infrastructure. Contact CinchOps today to ensure your Dell PowerScale environment is secure against CVE-2025-27690 and other critical threats.

 Discover More 

Discover more about our enterprise-grade and business protecting cybersecurity services on our Cybersecurity page.

Discover more about the importance of patch management: Why Patch Management Matters: Keeping Your Systems Secure and Efficient

For Additional Information on this topic, check out: Dell Warns of Critical PowerScale OneFS Vulnerabilities

FREE CYBERSECURITY ASSESSMENT