Cyber Posture

CVE-2025-22472

High

Published: 17 March 2025

Published
17 March 2025
Modified
14 July 2025
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0018 39.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse Unix shell commands and scripts for execution.

Security Summary

CVE-2025-22472 is a command injection vulnerability (CWE-77) in Dell SmartFabric OS10 Software, affecting versions 10.5.4.x, 10.5.5.x, 10.5.6.x, and 10.6.0.x. The flaw stems from improper neutralization of special elements used in a command, which can allow arbitrary command execution. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.

A low-privileged attacker with local access to the system can exploit this vulnerability. Successful exploitation enables the execution of arbitrary commands with elevated privileges, potentially allowing full compromise of the affected OS10 instance.

Dell has addressed this issue through multiple security advisories, including DSA-2025-070, DSA-2025-069, DSA-2025-079, and DSA-2025-068, available at the referenced KB documents. These updates provide patches and mitigation guidance for vulnerable OS10 versions.

Details

CWE(s)
CWE-77

Affected Products

dell
smartfabric os10
10.5.4.0 — 10.5.4.14 · 10.5.5.0 — 10.5.5.13 · 10.5.6.0 — 10.5.6.8

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

Command injection (CWE-77) in OS10 directly enables arbitrary command execution with elevated privileges from local low-privileged access, mapping to T1068 (Exploitation for Privilege Escalation) and T1059.004 (Unix Shell) for command interpreter abuse.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References