Read the docs
TI-2025-16295 Aliases CVE-2025-22397GHSA-95fw-x52j-jfx5

Path traversal in Dell Integrated Dell Remote Access Controller 9 14G Versions

Priority LOW 30CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00461 40th percentileScored 2026-11-07
Fix Fixed Integrated Dell Remote Access Controller 9 14G Versions (Dell): 7.00.00.181Integrated Dell Remote Access Controller 9 15G and 16G versions (Dell): 7.20.10.50+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellIntegrated Dell Remote Access Controller 9 14G VersionsN/A to before 7.00.00.1817.00.00.181Patch availableCNA
DellIntegrated Dell Remote Access Controller 9 15G and 16G versions6.10.80.00 to before 7.20.10.507.20.10.50Patch availableCNA
DellIntegrated Dell Remote Access Controller 10 17G versionN/A to before 1.20.25.001.20.25.00Patch availableCNA
  • Integrated Dell Remote Access Controller 9 14G Versions VendorDell Affected N/A to before 7.00.00.181 Fixed in 7.00.00.181 Patch available CNA
  • Integrated Dell Remote Access Controller 9 15G and 16G versions VendorDell Affected 6.10.80.00 to before 7.20.10.50 Fixed in 7.20.10.50 Patch available CNA
  • Integrated Dell Remote Access Controller 10 17G version VendorDell Affected N/A to before 1.20.25.00 Fixed in 1.20.25.00 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:o:dell:idrac9_firmware:*:*:*:*:*:*:*:*6.10.80.00 to before 7.00.00.181; 7.00.00.183 to before 7.20.10.50VulnerableDell
cpe:2.3:h:dell:idrac9:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:idrac10_firmware:*:*:*:*:*:*:*:*before 1.20.25.00VulnerableDell
cpe:2.3:h:dell:idrac10:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
  • cpe:2.3:o:dell:idrac9_firmware:*:*:*:*:*:*:*:* Versions 6.10.80.00 to before 7.00.00.181; 7.00.00.183 to before 7.20.10.50 Vulnerable ·Dell
  • cpe:2.3:h:dell:idrac9:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:idrac10_firmware:*:*:*:*:*:*:*:* Versions before 1.20.25.00 Vulnerable ·Dell
  • cpe:2.3:h:dell:idrac10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell

Remediation

  • Fix · CNA Integrated Dell Remote Access Controller 9 14G Versions (Dell) Fixed in 7.00.00.181
  • Fix · CNA Integrated Dell Remote Access Controller 9 15G and 16G versions (Dell) Fixed in 7.20.10.50
  • Fix · CNA Integrated Dell Remote Access Controller 10 17G version (Dell) Fixed in 1.20.25.00

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-22397
  2. 2026-10-03 Alias added: GHSA-95fw-x52j-jfx5

References

Advisory 1

  • TI-2026-27312 Insufficiently protected credentials in Dell iDRAC10 CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences