An authentication bypass exists in the Geo replication feature of Dell ECS and ObjectScale, where an attacker can assume data is immutable and exploit that assumption to override authentication checks. This weakness allows an unauthenticated remote attacker to gain unauthorized access to data that is being transferred between replication sites, potentially exposing sensitive information. The flaw belongs to the CWE-302 category, indicating a subverted authentication weakness that can lead to confidentiality breaches.

Affected are Dell ECS versions 3.8.1.0 through 3.8.1.7 and any Dell ObjectScale deployment running a version earlier than 4.3.0.0. These systems enable inter‑site Geo replication and, if not updated, can be vulnerable to an unauthorized data‑access exploit.

The CVSS score of 5.6 classifies this vulnerability as moderate in severity. The EPSS score below 1% implies a very low but nonzero probability of exploitation, and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote access to the replication interface; an unauthenticated attacker who can reach the Geo replication endpoints could trigger the bypass, thereby retrieving data in transit. The threat remains limited to systems that have the vulnerable range of ECS or ObjectScale installed and are exposed to network traffic used for replication.