CVE-2023-25940 MEDIUM

CVE-2023-25940

Vendor Dell

Product PowerScale OneFS

Weakness CWE-59

Published April 4, 2023

Last update February 11, 2025

View on NVD All CVEs

CVSS base score

6.7/10

Attack vector Local

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Dell PowerScale OneFS version 9.5.0.0 contains improper link resolution before file access vulnerability in isi_gather_info. A high privileged local attacker could potentially exploit this vulnerability, leading to system takeover and it breaks the compliance mode guarantees.

Key dates

02Disclosure timeline

April 4, 2023 CVE published

February 11, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-25940 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/59.html

Related vulnerabilities

04Related CVE

CVE-2025-15541 Access to System Files via SFTP on TP-Link VX800v CVE-2025-12341 ermig1979 AntiDupl Delete Duplicate Image AntiDupl.NET.WinForms.exe link following CVE-2026-6959 Nomad vulnerable to arbitrary file read/write on client host through symlink attack CVE-2025-7073 Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security CVE-2021-32549 apport read_file() function could follow maliciously constructed symbolic links