CVE-2025-46617
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedQuantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification of some software configuration parameters via undocumented user credentials. This affects StorNext RYO before 7.2.4, StorNext Xcellis Workflow Director before 7.2.4, and ActiveScale Cold Storage.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe Quantum StorNext Web GUI API versions prior to 7.2.4 contain undocumented user credentials that provide unauthorized access to internal StorNext configuration data and allow modification of certain software configuration parameters, enabling both confidentiality and integrity compromises.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify StorNext installationLocate Quantum StorNext software on the system by checking for StorNext processes, services, or installation directories. Common locations include /usr/stornext, /opt/stornext, or look for 'stornext' in running services.Affected if StorNext software is present in the environment
-
Determine StorNext Web GUI versionAccess the StorNext Web GUI interface and navigate to the version/about information page, or use available command-line interfaces to query the installed version of the StorNext Web GUI API component.Affected if The installed version is displayed as prior to 7.2.4
-
Verify undocumented accountsReview the Web GUI user account list and check for any undocumented, non-standard, or hidden user accounts that were not created by your organization. Compare against your known authorized user list.Affected if Unexpected or undocumented user accounts exist in the StorNext Web GUI
If the Quantum StorNext Web GUI API version is 7.2.3 or earlier, the environment contains the undocumented credentials vulnerability.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpgrade StorNext installations (RYO, Xcellis Workflow Director, and ActiveScale Cold Storage) to version 7.2.4 or later to remove the undocumented credentials and remediate the configuration access vulnerability.
StorNext 7.2.4 or later (including StorNext RYO, StorNext Xcellis Workflow Director, and ActiveScale Cold Storage)
- Identify all affected Quantum StorNext installations in your environment (StorNext RYO, StorNext Xcellis Workflow Director, and ActiveScale Cold Storage)
- Review current configuration and create a backup
- Upgrade to StorNext version 7.2.4 or later for all affected products
- After upgrade, verify the Web GUI API no longer contains undocumented/hardcoded credentials
- Review and audit any configuration parameters that may have been modified through the vulnerability
- Change any credentials that may have been exposed or are similar to documented default credentials
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation6.0 h
- Implementation8.0 h
- Testing6.0 h
- Review / QA4.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,816.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-46617 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-46617 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data