CVE-2025-21106
Dell Recoverpoint For Virtual Machines 6.0
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2025-21106 is a medium-severity Incorrect Default Permissions (CWE-276) vulnerability in Dell Recoverpoint For Virtual Machines. Its CVSS base score is 5.5 (Medium).
Operationally, ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4601
Vulnerability Data
Dell Recover Point for Virtual Machines 6.0.X contains a Weak file system permission vulnerability. A low privileged Local attacker could potentially exploit this vulnerability, leading to impacting only non-sensitive resources in the system.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces file-system access control policies so that low-privileged local users cannot read or modify files beyond their authorization.
Requires that file and directory permissions be assigned according to the principle of least privilege, eliminating the overly permissive settings that enable this CWE-276 flaw.
Mandates secure baseline configuration settings, including explicit file-system permission values that would have prevented the weak permissions shipped in RecoverPoint 6.0.X.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened baselines and configuration management explicitly require correct default file permissions.
Defining and enforcing least-privilege access permissions directly prevents overly permissive defaults at install time.
Lifecycle management can encompass permission settings, yet the control is too broad to specifically mitigate incorrect defaults.
Secure SDLC practices include establishing secure defaults, but address only the development-phase portion of the weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Standard templates that restrict access to utility programs and host parameter settings prevent the assignment of overly permissive default permissions on critical resources.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Windows Server 2016 (1 rule)
- V-224833 Permissions for program file directories must conform to minimum requirements. via CWE-276
Windows Server 2019 (2 rules)
- V-205735 Windows Server 2019 permissions for program file directories must conform to minimum requirements. via CWE-276
- V-205736 Windows Server 2019 permissions for the Windows installation directory must conform to minimum requirements. via CWE-276
Windows Server 2022 (2 rules)
- V-254252 Windows Server 2022 permissions for program file directories must conform to minimum requirements. via CWE-276
- V-254253 Windows Server 2022 permissions for the Windows installation directory must conform to minimum requirements. via CWE-276