TI-2025-16297 Aliases CVE-2025-22399 GHSA-wr7v-68p8-38hw

Server-side request forgery in Dell UCC Edge

LOW 33CWE-918Published 2025-02-11 · Updated 2025-02-12

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Dell UCC Edge, version 2.3.0, contains a Blind SSRF on Add Customer SFTP Server vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Server-side request forgery

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00152 4th percentileScored 2026-11-07

Fix Fixed UCC Edge (Dell): 3.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dell	UCC Edge	N/A to before 3.0.0	3.0.0	Patch available	CNA

UCC Edge VendorDell Affected N/A to before 3.0.0 Fixed in 3.0.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:dell:utility_configuration_collector_edge:2.3.0:::::::*	2.3.0	Vulnerable	Dell

cpe:2.3:a:dell:utility_configuration_collector_edge:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·Dell

Remediation

Fix · CNA UCC Edge (Dell) Fixed in 3.0.0

Timeline

2026-10-02 Threatist record created from CVE-2025-22399
2026-10-03 Alias added: GHSA-wr7v-68p8-38hw

References

Patch 1

https://www.dell.com/support/kbdoc/en-us/000279299/dsa-2025-043-security-update-for-dell-ucc-edge-security-update-for-multiple-vulnerabilities

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences