Read the docs
TI-2025-17145 Aliases CVE-2025-23374GHSA-xwc6-4mcf-7v2v

Sensitive information in log files in Dell Enterprise SONiC OS

Priority LOW 37CWE-532Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

Dell Networking Switches running Enterprise SONiC OS, version(s) prior to 4.4.1 and 4.2.3, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00348 28th percentileScored 2026-11-07
Fix Fixed Enterprise SONiC OS (Dell): 4.4.1, 4.2.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellEnterprise SONiC OSN/A to before 4.4.1; N/A to before 4.2.34.4.1, 4.2.3Patch availableCNA
  • Enterprise SONiC OS VendorDell Affected N/A to before 4.4.1; N/A to before 4.2.3 Fixed in 4.4.1, 4.2.3 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:dell:enterprise_sonic_distribution:*:*:*:*:*:*:*:*before 4.2.3VulnerableDell
cpe:2.3:o:dell:enterprise_sonic_distribution:4.4.0:*:*:*:*:*:*:*4.4.0VulnerableDell
  • cpe:2.3:o:dell:enterprise_sonic_distribution:*:*:*:*:*:*:*:* Versions before 4.2.3 Vulnerable ·Dell
  • cpe:2.3:o:dell:enterprise_sonic_distribution:4.4.0:*:*:*:*:*:*:* Versions 4.4.0 Vulnerable ·Dell

Remediation

  • Fix · CNA Enterprise SONiC OS (Dell) Fixed in 4.4.1, 4.2.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-23374
  2. 2026-10-03 Alias added: GHSA-xwc6-4mcf-7v2v

References

Advisory 1

  • TI-2023-15766 Improper input validation in Dell Enterprise SONiC OS CVSS 3.1CRITICAL 9.8
  • TI-2024-30733 OS command injection in Dell Enterprise SONiC OS CVSS 3.1CRITICAL 9.1
  • TI-2024-30731 OS command injection in Dell Enterprise SONiC OS CVSS 3.1CRITICAL 9.1
  • TI-2024-30732 Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in… CVSS 3.1CRITICAL 9.8
  • TI-2023-10192 Uncontrolled resource consumption in Dell Enterprise SONiC OS CVSS 3.1HIGH 7.5
  • TI-2022-15323 Hard-coded credentials in Dell Enterprise SONiC OS CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences