CVE-2025-22397

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-22397", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "state": "PUBLISHED", "assignerShortName": "dell", "dateReserved": "2025-01-06T13:40:01.387Z", "datePublished": "2025-11-06T18:46:04.736Z", "dateUpdated": "2025-11-06T19:30:39.315Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Integrated Dell Remote Access Controller 9 14G Versions", "vendor": "Dell", "versions": [{"lessThan": "7.00.00.181", "status": "affected", "version": "N/A", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Integrated Dell Remote Access Controller 9 15G and 16G versions", "vendor": "Dell", "versions": [{"lessThan": "7.20.10.50", "status": "affected", "version": "6.10.80.00", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Integrated Dell Remote Access Controller 10 17G version", "vendor": "Dell", "versions": [{"lessThan": "1.20.25.00", "status": "affected", "version": "N/A", "versionType": "semver"}]}], "datePublic": "2025-11-06T18:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."}], "value": "Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2025-11-06T18:46:04.736Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000384516/dsa-2025-376-security-update-for-dell-idrac9-and-idrac10-vulnerabilities"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-06T19:29:27.509712Z", "id": "CVE-2025-22397", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-06T19:30:39.315Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-22397", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-06T19:29:27.509712Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-06T19:30:34.833Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dell", "product": "Integrated Dell Remote Access Controller 9 14G Versions", "versions": [{"status": "affected", "version": "N/A", "lessThan": "7.00.00.181", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Dell", "product": "Integrated Dell Remote Access Controller 9 15G and 16G versions", "versions": [{"status": "affected", "version": "6.10.80.00", "lessThan": "7.20.10.50", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Dell", "product": "Integrated Dell Remote Access Controller 10 17G version", "versions": [{"status": "affected", "version": "N/A", "lessThan": "1.20.25.00", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2025-11-06T18:00:00.000Z", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000384516/dsa-2025-376-security-update-for-dell-idrac9-and-idrac10-vulnerabilities", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.", "supportingMedia": [{"type": "text/html", "value": "Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2025-11-06T18:46:04.736Z"}}}, "cveMetadata": {"cveId": "CVE-2025-22397", "state": "PUBLISHED", "dateUpdated": "2025-11-06T19:30:39.315Z", "dateReserved": "2025-01-06T13:40:01.387Z", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "datePublished": "2025-11-06T18:46:04.736Z", "assignerShortName": "dell"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Integrated Dell Remote Access Controller 9 14G Versions", "vendor": "Dell", "versions": [{"lessThan": "7.00.00.181", "status": "affected", "version": "N/A", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Integrated Dell Remote Access Controller 9 15G and 16G versions", "vendor": "Dell", "versions": [{"lessThan": "7.20.10.50", "status": "affected", "version": "6.10.80.00", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Integrated Dell Remote Access Controller 10 17G version", "vendor": "Dell", "versions": [{"lessThan": "1.20.25.00", "status": "affected", "version": "N/A", "versionType": "semver"}]}], "source": "security_alert@emc.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dell:idrac9_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "AFA88EBF-1790-472B-BCF7-6D0C52AE8FBD", "versionEndExcluding": "7.00.00.181", "versionStartIncluding": "6.10.80.00", "vulnerable": true}, {"criteria": "cpe:2.3:o:dell:idrac9_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5FD8EDE3-C72D-40B8-9260-DC8A00748F0B", "versionEndExcluding": "7.20.10.50", "versionStartIncluding": "7.00.00.183", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dell:idrac9:-:*:*:*:*:*:*:*", "matchCriteriaId": "BD8B684E-092F-496C-9D94-51CCD1F3575A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dell:idrac10_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "0362FAE2-88A8-4FB0-B985-BD8FE569D214", "versionEndExcluding": "1.20.25.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dell:idrac10:-:*:*:*:*:*:*:*", "matchCriteriaId": "5BFCEF7B-7BE5-49C4-9206-C8417174E313", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."}, {"lang": "es", "value": "Dell Integrated Dell Remote Access Controller 9, versiones 14G anteriores a la 7.00.00.181, versiones 15G y 16G de la 6.10.80.00 a la 7.20.10.50 y Dell Integrated Dell Remote Access Controller 10, versiones 17G anteriores a la 1.20.25.00, contienen una vulnerabilidad de limitaci\u00f3n inadecuada de un nombre de ruta a un directorio restringido ('salto de ruta'). Un atacante con altos privilegios y acceso remoto podr\u00eda potencialmente explotar esta vulnerabilidad, lo que podr\u00eda llevar a un acceso no autorizado."}], "id": "CVE-2025-22397", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.5, "source": "security_alert@emc.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-22397", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-06T19:29:27.509712Z", "version": "2.0.3"}}]}, "published": "2025-11-06T19:15:41.153", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000384516/dsa-2025-376-security-update-for-dell-idrac9-and-idrac10-vulnerabilities"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security_alert@emc.com", "type": "Secondary"}]}

{}

{"created": "2025-11-07T10:53:54.796398+00:00", "updated": "2025-11-07T10:53:54.796444+00:00", "vendors": ["dell", "dell$PRODUCT$integrated_dell_remote_access_controller_10", "dell$PRODUCT$integrated_dell_remote_access_controller_9"]}