CVE-2025-45378
BaseFortify
Publication date: 2025-11-05
Last updated on: 2025-11-07
Assigner: Dell
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dell | cloudlink | From 8.0 (inc) to 8.1.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Dell CloudLink versions 8.0 through 8.1.2, where a privileged user with a known password can bypass the restricted shell and gain full command shell access on the CloudLink server. This allows the user to escalate privileges and gain unauthorized system access. If SSH is enabled using the server's web credentials, an attacker can exploit this vulnerability remotely over the network using the known privileged user credentials.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access and full control over the affected CloudLink server. An attacker with known privileged credentials can escalate privileges, execute arbitrary commands, and potentially compromise the confidentiality, integrity, and availability of the system and its data.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can focus on identifying if SSH is enabled on the CloudLink server and if privileged user credentials are being used. Commands to check SSH service status and active sessions include: 'systemctl status ssh' or 'service ssh status' to verify SSH is running, and 'who' or 'w' to see logged-in users. Additionally, monitoring for unusual shell access by privileged users may help detect exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling SSH access using web credentials on the CloudLink server, changing privileged user passwords to strong, unique values, and restricting SSH access to trusted hosts only. Applying any available patches or updates from Dell for CloudLink versions 8.0 through 8.1.2 is also recommended.