CVE-2025-22397
Full vulnerability record from the local CVENow database.
Description
Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
Severity
MEDIUM
CVSS score
4.9
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2025-11-06 19:15:41.153000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-22397",
"sourceIdentifier": "[email protected]",
"published": "2025-11-06T19:15:41.153",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."
},
{
"lang": "es",
"value": "Dell Integrated Dell Remote Access Controller 9, versiones 14G anteriores a la 7.00.00.181, versiones 15G y 16G de la 6.10.80.00 a la 7.20.10.50 y Dell Integrated Dell Remote Access Controller 10, versiones 17G anteriores a la 1.20.25.00, contienen una vulnerabilidad de limitación inadecuada de un nombre de ruta a un directorio restringido ('salto de ruta'). Un atacante con altos privilegios y acceso remoto podría potencialmente explotar esta vulnerabilidad, lo que podría llevar a un acceso no autorizado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Dell",
"product": "Integrated Dell Remote Access Controller 9 14G Versions",
"defaultStatus": "unaffected",
"versions": [
{
"version": "N/A",
"lessThan": "7.00.00.181",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Dell",
"product": "Integrated Dell Remote Access Controller 9 15G and 16G versions",
"defaultStatus": "unaffected",
"versions": [
{
"version": "6.10.80.00",
"lessThan": "7.20.10.50",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Dell",
"product": "Integrated Dell Remote Access Controller 10 17G version",
"defaultStatus": "unaffected",
"versions": [
{
"version": "N/A",
"lessThan": "1.20.25.00",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.2,
"impactScore": 5.5
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.2,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-11-06T19:29:27.509712Z",
"id": "CVE-2025-22397",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:dell:idrac9_firmware:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.10.80.00",
"versionEndExcluding": "7.00.00.181",
"matchCriteriaId": "AFA88EBF-1790-472B-BCF7-6D0C52AE8FBD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:dell:idrac9_firmware:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.00.00.183",
"versionEndExcluding": "7.20.10.50",
"matchCriteriaId": "5FD8EDE3-C72D-40B8-9260-DC8A00748F0B"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:dell:idrac9:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BD8B684E-092F-496C-9D94-51CCD1F3575A"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:dell:idrac10_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.20.25.00",
"matchCriteriaId": "0362FAE2-88A8-4FB0-B985-BD8FE569D214"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:dell:idrac10:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5BFCEF7B-7BE5-49C4-9206-C8417174E313"
}
]
}
]
}
],
"references": [
{
"url": "https://www.dell.com/support/kbdoc/en-us/000384516/dsa-2025-376-security-update-for-dell-idrac9-and-idrac10-vulnerabilities",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}