← Vulnerability feed

Vulnerability record · CVE-2017-14374 · published 6 December 2017

CVE-2017-14374: Dell storage manager hard-coded credentials vulnerability

Dell · Storage Manager

The SMI-S service in Dell Storage Manager versions earlier than 16.3.20 (aka 2016 R3.20) is protected using a hard-coded password. A remote user with the knowledge of the password might potentially disable the SMI-S service via HTTP requests, affecting storage management and monitoring functionality via the SMI-S interface. This issue, aka DSM-30415, only affects a Windows installation of the Data Collector (not applicable to the virtual appliance).

9.8 CVSS 3.0 Critical EPSS 1.3% · top 30.3% CWE-798 · Hard-coded credentials
9.8CVSS 3.0 base score, v2 7.5
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

The SMI-S service in Dell Storage Manager versions earlier than 16.3.20 (aka 2016 R3.20) is protected using a hard-coded password. A remote user with the knowledge of the password might potentially disable the SMI-S service via HTTP requests, affecting storage management and monitoring functionality via the SMI-S interface. This issue, aka DSM-30415, only affects a Windows installation of the Data Collector (not applicable to the virtual appliance).

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://topics-cdn.dell.com/pdf/storage-sc2000_release%20notes24_en-us.pdf Release NotesVendor Advisory
http://topics-cdn.dell.com/pdf/storage-sc2000_release%20notes24_en-us.pdf Release NotesVendor Advisory

Track CVE-2017-14374 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-43995Dell storage manager improper authentication vulnerabilityDell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with…EPSS 0.84%8.8CVE-2025-22477Dell storage manager improper authentication vulnerabilityDell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with…EPSS 0.29%8.1CVE-2025-22478Dell storage manager xml external entity (xxe) vulnerabilityDell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. An…EPSS 0.27%8.0CVE-2025-22476Dell storage manager command injection vulnerabilityDell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command…EPSS 0.55%7.5CVE-2025-43994Dell storage manager missing authentication for critical function vulnerabilityDell Storage Center - Dell Storage Manager, version(s) DSM 20.1.21, contain(s) a Missing Authentication for Critical Function vulnerability. An unaut…EPSS 0.60%6.5CVE-2025-46425Dell storage manager xml external entity (xxe) vulnerabilityDell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A …EPSS 0.33%6.5CVE-2017-14384Dell storage manager path traversal vulnerabilityIn Dell Storage Manager versions earlier than 16.3.20, the EMConfigMigration service is affected by a directory traversal vulnerability. A remote mal…EPSS 1.8%5.2CVE-2025-23379Dell storage manager cross-site scripting vulnerabilityDell Storage Center - Dell Storage Manager, version(s) 21.0.20, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-sit…EPSS 0.25%

Source: NIST National Vulnerability Database (record CVE-2017-14374), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.