Read the docs
TI-2025-40729 Aliases CVE-2025-66237GHSA-4xp3-78mx-mpfq

Sunbird DCIM dcTrack and Power IQ Use of Hard-coded Credentials

Priority LOW 37CWE-798Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

DCIM dcTrack platforms utilize default and hard-coded credentials for access. An attacker could use these credentials to administer the database, escalate privileges on the platform or execute system commands on the host.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00144 3rd percentileScored 2026-11-07
Fix Fixed DCIM dcTrack (Sunbird): 9.2.3Power IQ (Sunbird): 9.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SunbirdDCIM dcTrackup to v9.2.09.2.3Patch availableCNA
SunbirdPower IQup to v9.2.09.2.1Patch availableCNA
  • DCIM dcTrack VendorSunbird Affected up to v9.2.0 Fixed in 9.2.3 Patch available CNA
  • Power IQ VendorSunbird Affected up to v9.2.0 Fixed in 9.2.1 Patch available CNA

Remediation

  • Fix · CNA DCIM dcTrack (Sunbird) Fixed in 9.2.3
  • Fix · CNA Power IQ (Sunbird) Fixed in 9.2.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66237
  2. 2026-10-03 Alias added: GHSA-4xp3-78mx-mpfq

References

Other 2

  • TI-2025-42992 An issue pertaining to CWE-352: Cross-Site Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. CVSS 3.1HIGH 8.8
  • TI-2025-42991 An issue pertaining to CWE-1333: Inefficient Regular Expression Complexity (4.19) was… CVSS 3.1HIGH 7.5
  • TI-2025-42990 An issue in Sunbird-Ed SunbirdEd-portal v1.13.4 allows attackers to obtain sensitive… CVSS 3.1HIGH 7.5
  • TI-2025-42989 An issue pertaining to CWE-22: Improper Limitation of a Pathname to a Restricted… CVSS 3.1HIGH 7.5
  • TI-2025-42988 An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in Sunbird-Ed… CVSS 3.1HIGH 7.5
  • TI-2025-40730 Sunbird DCIM dcTrack and Power IQ Authentication Bypass Using an Alternate Path or Channel CVSS 4.0HIGH 7.4
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences