CVE-2025-46427
Published: 12 November 2025
Summary
CVE-2025-46427 is a high-severity Command Injection (CWE-77) vulnerability in Dell Smartfabric Os10. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Device CLI (T1059.008); ranked at the 26.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents command injection by requiring validation and neutralization of special elements in remote command inputs.
SI-2 ensures timely remediation of the specific command injection flaw through application of Dell's OS10 security patch.
AC-6 least privilege limits the damage potential from command execution by constraining low-privileged remote attackers.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection vulnerability directly enables arbitrary command execution via Network Device CLI (T1059.008) and exploitation of the remote management service (T1210).
NVD Description
Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
Deeper analysisAI
CVE-2025-46427 is an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability, classified under CWE-77, affecting Dell SmartFabric OS10 Software in versions prior to 10.6.1.0. Published on 2025-11-12, it allows special elements in commands to be inadequately sanitized, enabling malicious input to alter command execution.
A low-privileged attacker with remote access can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation leads to command execution on the affected system, granting high confidentiality, integrity, and availability impacts as reflected in its CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Dell's security advisory DSA-2025-407 details a security update addressing this and other Dell Networking OS10 vulnerabilities. Practitioners should consult the advisory at https://www.dell.com/support/kbdoc/en-us/000391062/dsa-2025-407-security-update-for-dell-networking-os10-vulnerabilities for patch deployment and mitigation guidance.
Details
- CWE(s)