Read the docs
TI-2025-15100 Aliases CVE-2025-21104GHSA-5c7g-5xj5-gpx3

Open redirect in Dell NetWorker

Priority LOW 29CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-601.

Summary

Dell NetWorker, versions prior to 19.11.0.4 and version 19.12, contains an URL Redirection to Untrusted Site ('Open Redirect') Vulnerability in NetWorker Management Console. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to a targeted application user being redirected to arbitrary web URLs. The vulnerability could be leveraged by attackers to conduct phishing attacks that cause users to divulge sensitive information.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00305 23rd percentileScored 2026-11-07
Fix Fixed NetWorker (Dell): 19.11.0.4, 19.12.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellNetWorkerN/A to before 19.11.0.4; 19.12 to before 19.12.0.119.11.0.4, 19.12.0.1Patch availableCNA
  • NetWorker VendorDell Affected N/A to before 19.11.0.4; 19.12 to before 19.12.0.1 Fixed in 19.11.0.4, 19.12.0.1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:dell:networker:*:*:*:*:*:*:*:*before 19.11.0.4VulnerableDell
cpe:2.3:a:dell:networker:19.12:*:*:*:*:*:*:*19.12VulnerableDell
  • cpe:2.3:a:dell:networker:*:*:*:*:*:*:*:* Versions before 19.11.0.4 Vulnerable ·Dell
  • cpe:2.3:a:dell:networker:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Dell

Remediation

  • Fix · CNA NetWorker (Dell) Fixed in 19.11.0.4, 19.12.0.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-21104
  2. 2026-10-03 Alias added: GHSA-5c7g-5xj5-gpx3

References

Advisory 1

  • TI-2023-10843 Code injection in Dell NetWorker NVE CVSS 3.1CRITICAL 9.8
  • TI-2024-28399 Authorization bypass in Dell NetWorker CVSS 3.1HIGH 8.3
  • TI-2023-12637 Improper authorization in Dell NetWorker CVSS 3.1HIGH 8.8
  • TI-2025-15103 Dell NetWorker, version(s) prior to 19.11.0.3, all versions of 19.10 & prior versions… CVSS 3.1HIGH 7.8
  • TI-2025-15099 Dell NetWorker Management Console, version(s) 19.11 through 19.11.0.3 & Versions prior to… CVSS 3.1HIGH 7.8
  • TI-2024-15003 Insufficiently protected credentials in Dell NetWorker Module for Databases and… CVSS 3.1HIGH 7.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences