Cyber Resilience

CVE-2025-22394

Race Condition in Dell Display Manager ≤ 2.3.2.20

Race Condition
Published
15 January 2025
Modified
04 February 2025
Patch / advisory
View advisory
CVSS Score v3.1 6.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0011 2th percentile
Risk Priority 45 floored blend · peak EPSS

Summary

CVE-2025-22394 is a medium-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Dell Display Manager. Its CVSS base score is 6.7 (Medium).

Operationally, ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Dell Display Manager, versions prior to 2.3.2.18, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to code execution and possibly privilege escalation.

CWE(s)
CWE-367

Related Threats

CVEs Like This One

CVE-2023-32451Same product: Dell Display Manager
CVE-2023-28047Same product: Dell Display Manager
CVE-2023-32474Same product: Dell Display Manager
CVE-2023-28046Same product: Dell Display Manager
CVE-2025-21101Same product: Dell Display Manager
CVE-2024-0163Same vendor: Dell
CVE-2026-22281Same vendor: Dell
CVE-2025-30101Same vendor: Dell
CVE-2023-28075Same vendor: Dell
CVE-2024-53289Same vendor: Dell

Affected Assets

dell
display manager
≤ 2.3.2.20

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-6 Least Privilege
  • SI-7 Software, Firmware, and Information Integrity
Detect
Catch it (NIST detect / respond)
  • SI-7 Software, Firmware, and Information Integrity
Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V15.4.2
  • V17.2.6

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Enforces access decisions atomically, directly blocking TOCTOU bypasses that allow a low-privileged local process to escalate via stale permission checks.

AC-6 Least Privilege good match
prevent

Restricts the attacker's initial low-privileged context, limiting the ability to reach or exploit the race condition for code execution or further escalation.

SI-7 Software, Firmware, and Information Integrity partial match
preventdetect

Requires integrity verification of executables and critical files before use, reducing the window for TOCTOU manipulation leading to unauthorized code execution.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.17 Clock synchronization none match
none

Reliable, synchronized time across systems narrows the exploitable window in which a resource state can change between a security check and its use.

References