Two significant security vulnerabilities affecting the Dell PowerScale OneFS storage operating system, with the most severe flaw potentially allowing unauthenticated attackers to gain complete unauthorized access to enterprise filesystem data.

The critical vulnerability, tracked as CVE-2024-53298, affects PowerScale OneFS versions 9.5.0.0 through 9.10.0.1 and carries a maximum CVSS score of 9.8, indicating an extremely high risk to organizational data security.

This disclosure is accompanied by a secondary SQL injection vulnerability (CVE-2025-32753) that could enable local privilege escalation attacks, creating a dual-threat scenario for enterprise storage environments.

NFS Export Authorization Bypass (CVE-2024-53298)

The most severe vulnerability, CVE-2024-53298, represents a fundamental breakdown in the Network File System (NFS) export authorization mechanism within Dell PowerScale OneFS.

This missing authorization vulnerability enables unauthenticated attackers with remote network access to completely bypass security controls and gain unauthorized filesystem access.

The vulnerability’s CVSS vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the attack can be executed remotely over a network with low complexity, requires no privileges or user interaction, and can result in high impact to confidentiality, integrity, and availability of data.

The technical implications of this vulnerability are particularly concerning for enterprise environments where PowerScale systems typically store mission-critical data and serve as central repositories for organizational file storage.

An attacker exploiting this flaw could potentially read sensitive corporate documents, modify critical system configurations, and delete entire filesystem structures without any authentication requirements.

The NFS protocol, commonly used for network-attached storage in enterprise environments, becomes a direct attack vector when this authorization check fails, effectively turning the storage system into an open repository accessible to any network-connected threat actor.

Risk Factors	Details
Affected Products	Dell PowerScale OneFS 9.5.0.0 through 9.10.0.1
Impact	Unauthorized filesystem access (read, modify, delete arbitrary files)
Exploit Prerequisites	Unauthenticated attacker with remote access
CVSS 3.1 Score	9.8 (Critical)

SQL Injection Flaw (CVE-2025-32753)

The secondary vulnerability, CVE-2025-32753, introduces an SQL injection attack vector within the PowerScale OneFS system, though it requires local access and low-level privileges to exploit.

This improper neutralization of special elements vulnerability carries a CVSS score of 5.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating moderate risk with local attack vectors requiring low privileges.

The vulnerability allows attackers to inject malicious SQL commands into database queries, potentially leading to denial of service conditions, unauthorized information disclosure, and data tampering capabilities.

While less severe than the NFS authorization bypass, this SQL injection vulnerability becomes particularly dangerous when combined with the remote access capabilities provided by CVE-2024-53298.

An attacker who gains initial access through the NFS vulnerability could potentially escalate their privileges using SQL injection techniques, creating a pathway for comprehensive system compromise.

The vulnerability affects the same version range (9.5.0.0 through 9.10.0.1), suggesting that organizations running affected PowerScale deployments face a compound security risk requiring immediate attention.

Risk Factors	Details
Affected Products	Dell PowerScale OneFS 9.5.0.0 through 9.10.0.1
Impact	Denial of service, information disclosure, data tampering
Exploit Prerequisites	Low-privileged attacker with local access
CVSS 3.1 Score	5.3 (Medium)

Remediation

Dell Technologies has classified the NFS authorization vulnerability as critical and strongly recommends that customers upgrade their PowerScale OneFS systems at the earliest opportunity.

System administrators should immediately assess their network exposure, implement network-level access controls as temporary mitigation measures, and plan urgent upgrade procedures to patched versions of OneFS.

Organizations should also conduct comprehensive security audits of their PowerScale deployments to identify any signs of unauthorized access or data compromise.

The combination of remote accessibility and local privilege escalation capabilities creates a significant attack surface that sophisticated threat actors could exploit to establish persistent access to enterprise storage environments, making rapid remediation essential for maintaining data security and regulatory compliance.

Live Credential Theft Attack Unmask & Instant Defense – Free Webinar

The post Dell PowerScale Vulnerability Let Attackers Gain Unauthorized Filesystem Access appeared first on Cyber Security News.