CVE-2025-21107
Published: 30 January 2025
Summary
CVE-2025-21107 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Dell Networker. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 16.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-21107 is an Unquoted Search Path or Element vulnerability (CWE-428) affecting Dell NetWorker in versions prior to 19.11.0.3, including all versions of 19.10 and earlier. This flaw exists in the backup and recovery software, where the unquoted path in a search element allows unintended executable resolution during system operations.
A low-privileged attacker with local access can exploit this vulnerability with low complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation enables arbitrary code execution with elevated privileges, potentially compromising the confidentiality, integrity, and availability of the affected system.
Dell Security Advisory DSA-2025-064, available at https://www.dell.com/support/kbdoc/en-us/000278811/dsa-2025-064-security-update-for-dell-networker-networker-virtual-edition-and-networker-management-console-multiple-component-vulnerabilities, details the security update addressing this and other vulnerabilities in NetWorker, NetWorker Virtual Edition, and NetWorker Management Console. Practitioners should apply the recommended patches to mitigate the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2225
Vulnerability details
Dell NetWorker, version(s) prior to 19.11.0.3, all versions of 19.10 & prior versions contain(s) an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct mapping from CWE-428 unquoted search path to T1574.009 Path Interception by Unquoted Path, enabling local privilege escalation to arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the unquoted search path vulnerability in Dell NetWorker by applying vendor patches to versions prior to 19.11.0.3, preventing low-privileged code execution.
Secure configuration settings enforce hardened permissions on search path directories, blocking low-privileged attackers from placing malicious executables to exploit the unquoted path flaw.
Least privilege enforcement limits the privileges available for exploitation, reducing the impact of code execution from low-privileged local access via the unquoted search path vulnerability.