Listen to this Post
How the CVE Works
CVE-2025-23378 affects Dell PowerScale OneFS versions 9.4.0.0 through 9.10.0.0. The vulnerability arises from improper directory listing restrictions, allowing a low-privileged local attacker to enumerate files and directories. This misconfiguration exposes sensitive system or user data without requiring elevated permissions. Attackers leverage this flaw to gather information for further exploitation, such as identifying configuration files, logs, or credentials stored inadvertently in accessible paths.
DailyCVE Form
Platform: Dell PowerScale OneFS
Version: 9.4.0.0 – 9.10.0.0
Vulnerability: Information Disclosure
Severity: Medium
Date: 07/15/2025
Prediction: Patch expected by 08/30/2025
What Undercode Say
Check directory permissions
ls -la /ifs/data/
Exploit PoC (local)
find /ifs -type d -exec ls {} \;
How Exploit
- Attacker gains local access.
- Enumerates directories via misconfigured listings.
- Exfiltrates sensitive files.
Protection from this CVE
- Apply vendor patch.
- Restrict directory permissions.
- Audit file system ACLs.
Impact
- Unauthorized data access.
- Potential credential leakage.
- Privilege escalation vector.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
