Read the docs
TI-2025-40730 Aliases CVE-2025-66238GHSA-q579-mcrq-q4vr

Sunbird DCIM dcTrack and Power IQ Authentication Bypass Using an Alternate Path or Channel

Priority LOW 35CWE-288Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-288.

Summary

DCIM dcTrack allows an attacker to misuse certain remote access features. An authenticated user with access to the appliance's virtual console could exploit these features to redirect network traffic, potentially accessing restricted services or data on the host machine.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00366 30th percentileScored 2026-11-07
Fix Fixed DCIM dcTrack (Sunbird): 9.2.3IQ (Sunbird): 9.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SunbirdDCIM dcTrackup to v9.2.09.2.3Patch availableCNA
SunbirdIQup to v9.2.09.2.1Patch availableCNA
  • DCIM dcTrack VendorSunbird Affected up to v9.2.0 Fixed in 9.2.3 Patch available CNA
  • IQ VendorSunbird Affected up to v9.2.0 Fixed in 9.2.1 Patch available CNA

Remediation

  • Fix · CNA DCIM dcTrack (Sunbird) Fixed in 9.2.3
  • Fix · CNA IQ (Sunbird) Fixed in 9.2.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66238
  2. 2026-10-03 Alias added: GHSA-q579-mcrq-q4vr

References

Other 2

  • TI-2025-42992 An issue pertaining to CWE-352: Cross-Site Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. CVSS 3.1HIGH 8.8
  • TI-2025-42991 An issue pertaining to CWE-1333: Inefficient Regular Expression Complexity (4.19) was… CVSS 3.1HIGH 7.5
  • TI-2025-42990 An issue in Sunbird-Ed SunbirdEd-portal v1.13.4 allows attackers to obtain sensitive… CVSS 3.1HIGH 7.5
  • TI-2025-42989 An issue pertaining to CWE-22: Improper Limitation of a Pathname to a Restricted… CVSS 3.1HIGH 7.5
  • TI-2025-42988 An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in Sunbird-Ed… CVSS 3.1HIGH 7.5
  • TI-2025-40729 Sunbird DCIM dcTrack and Power IQ Use of Hard-coded Credentials CVSS 4.0HIGH 8.4
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences