CVE-2025-36591

Dell ECS and Dell ObjectScale use a broken or risky cryptographic algorithm (CWE-327) to protect certain data, allowing it to be decrypted or reconstructed by someone who obtains the stored output. Exploitation requires an attacker who already has high-privileged local access to the system, so it is best viewed as a privilege-escalation/information-disclosure weakness for insiders or attackers who have compromised the appliance. A successful exploit results in exposure of confidential information (confidentiality impact only; integrity and availability are unaffected). Organizations running Dell ECS versions 3.8.1.0 through 3.8.1.7 or ObjectScale versions prior to 4.4.0.0 are affected. There are currently no reports of in-the-wild exploitation, no CISA KEV listing, and no known public proof-of-concept.

What to do: Upgrade ObjectScale to 4.4.0.0 or later, and upgrade ECS from the 3.8.1.x line to a fixed release per Dell's security advisory (Dell security alert DSA-2025-XXX for CVE-2025-36591). Because exploitation requires high-privileged local access, restrict administrative and shell access to ECS/ObjectScale nodes to trusted operators, and review and rotate secrets or credentials that may have been protected by the weak algorithm on affected versions.