CVE-2025-22473
Published: 17 March 2025
Summary
CVE-2025-22473 is a high-severity Command Injection (CWE-77) vulnerability in Dell Smartfabric Os10. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 34.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-22473 is a command injection vulnerability (CWE-77), classified as Improper Neutralization of Special Elements used in a Command, affecting Dell SmartFabric OS10 Software in versions 10.5.4.x, 10.5.5.x, 10.5.6.x, and 10.6.0.x. Published on 2025-03-17, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts from a local, low-privilege attack with low complexity and no user interaction required.
A low-privileged attacker with local access to the affected system can exploit this vulnerability to execute arbitrary code, potentially gaining escalated control over the device.
Dell has issued multiple security advisories addressing this and related OS10 vulnerabilities, including DSA-2025-070 (KB000289970), DSA-2025-069 (KB000293638), DSA-2025-079 (KB000294091), and DSA-2025-068 (KB000295014). These documents detail security updates and patches; administrators should review them for specific mitigation guidance and apply the recommended fixes promptly.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6533
Vulnerability details
Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local command injection (CWE-77) allows low-privileged attackers to execute arbitrary code on Dell OS10, directly enabling T1068 for privilege escalation and T1059.004 for Unix Shell command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely remediation through application of Dell security patches directly eliminates the command injection vulnerability in OS10 software.
Validates and sanitizes inputs to command interfaces, directly neutralizing special elements exploited in this command injection vulnerability.
Enforces least privilege for local low-privileged accounts, limiting the scope and impact of arbitrary code execution resulting from the injection.