Dell PowerScale OneFS Vulnerability Allows Account Takeover via Default Passwords

Recent security findings have revealed vulnerabilities in Dell's NAS operating system, PowerScale OneFS, prompting the company to address multiple security flaws in its current versions. These vulnerabilities could potentially allow attackers to gain unauthorized access to sensitive network storage systems.

Security experts have identified six distinct weaknesses within the PowerScale OneFS framework that could be exploited by malicious actors. The most critical of these vulnerabilities, classified under CVE-2025-27690, arises from the use of a default password, enabling attackers to remotely seize accounts with elevated user privileges without needing any authentication. This severity level suggests that once compromised, devices could be fully taken over by unauthorized users.

In addition to this critical vulnerability, there is another significant flaw labeled as CVE-2025-26330, which has been rated as high severity. This issue allows unauthorized access by local attackers who have not logged in, primarily due to lingering permissions associated with disabled accounts.

The remaining vulnerabilities are categorized as medium and low severity, with some being susceptible to Denial of Service (DoS) attacks. While the specific details regarding the potential exploitation of these weaknesses remain unclear, the risks they pose to data integrity and system functionality are substantial.

Dell's recent advisory did not indicate whether any active attacks exploiting these vulnerabilities have occurred. Additionally, it is uncertain how attackers might identify compromised NAS systems. In response to the identified vulnerabilities, Dell has released patches in the following versions of PowerScale OneFS: 9.4.0.219.5.1.39.7.1.59.7.1.79.8.0.49.9.0.29.10.1.1.

For administrators unable to apply these security updates immediately, Dell has provided workarounds to help secure systems against the critical flaw until proper patches can be implemented. These measures are detailed in the advisory released by Dell.