CVE-2025-21107
Published: 30 January 2025
Description
Dell NetWorker, version(s) prior to 19.11.0.3, all versions of 19.10 & prior versions contain(s) an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.
Security Summary
CVE-2025-21107 is an Unquoted Search Path or Element vulnerability (CWE-428) affecting Dell NetWorker in versions prior to 19.11.0.3, including all versions of 19.10 and earlier. This flaw exists in the backup and recovery software, where the unquoted path in a search element allows unintended executable resolution during system operations.
A low-privileged attacker with local access can exploit this vulnerability with low complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation enables arbitrary code execution with elevated privileges, potentially compromising the confidentiality, integrity, and availability of the affected system.
Dell Security Advisory DSA-2025-064, available at https://www.dell.com/support/kbdoc/en-us/000278811/dsa-2025-064-security-update-for-dell-networker-networker-virtual-edition-and-networker-management-console-multiple-component-vulnerabilities, details the security update addressing this and other vulnerabilities in NetWorker, NetWorker Virtual Edition, and NetWorker Management Console. Practitioners should apply the recommended patches to mitigate the risk.
Details
- CWE(s)