Cyber Resilience

CVE-2025-30101

Race Condition in Dell Powerscale Onefs 9.8.0.0 – 9.10.1.2

Race Condition
Published
08 May 2025
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 4.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
EPSS Score 0.0014 4th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-30101 is a medium-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Dell Powerscale Onefs. Its CVSS base score is 4.4 (Medium).

Operationally, ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-7 (Software, Firmware, and Information Integrity) and AC-6 (Least Privilege) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Dell PowerScale OneFS, versions 9.8.0.0 through 9.10.1.0, contain a time-of-check time-of-use (TOCTOU) race condition vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to denial of service and information tampering.

CWE(s)
CWE-367

Related Threats

CVEs Like This One

CVE-2026-22281Same product: Dell Powerscale Onefs
CVE-2025-22471Same product: Dell Powerscale Onefs
CVE-2024-22449Same product: Dell Powerscale Onefs
CVE-2024-25953Same product: Dell Powerscale Onefs
CVE-2023-32493Same product: Dell Powerscale Onefs
CVE-2025-30477Same product: Dell Powerscale Onefs
CVE-2023-32492Same product: Dell Powerscale Onefs
CVE-2024-49602Same product: Dell Powerscale Onefs
CVE-2026-24511Same product: Dell Powerscale Onefs
CVE-2023-44295Same product: Dell Powerscale Onefs

Affected Assets

dell
powerscale onefs
9.8.0.0 — 9.10.1.2

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-7 Software, Firmware, and Information Integrity
  • SC-39 Process Isolation
  • AC-6 Least Privilege
Detect
Catch it (NIST detect / respond)
  • SI-7 Software, Firmware, and Information Integrity
Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V15.4.2
  • V17.2.6

Mitigating Controls (NIST 800-53 r5) AI

SI-7 Software, Firmware, and Information Integrity good match
preventdetect

Directly counters the information tampering outcome of the TOCTOU race by verifying software/firmware/information integrity before and after file operations.

SC-39 Process Isolation partial match
prevent

Process isolation limits the blast radius of a local unauthenticated TOCTOU race condition so one process cannot affect another's check-use sequence.

AC-6 Least Privilege partial match
prevent

Least-privilege assignment reduces the set of local actions an unauthenticated user can perform, shrinking the attack surface that enables the race.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.17 Clock synchronization none match
none

Reliable, synchronized time across systems narrows the exploitable window in which a resource state can change between a security check and its use.

References