{"id":"CVE-2025-21105","state":"PUBLISHED","title":"Dell RecoverPoint for Virtual Machines 6.0.X contains a command execution vulnerability. A Low privileged malicious user with local access could potentially exploit this vulnerabil","description":"Dell RecoverPoint for Virtual Machines 6.0.X contains a command execution vulnerability. A Low privileged malicious user with local access could potentially exploit this vulnerability by running the specific binary and perform any administrative action permitted by it resulting in shutting down the server, modifying the configuration leading to gain access to unauthorized data.","publishedAt":"2025-02-20T12:10:15.653Z","updatedAt":"2025-02-20T13:59:59.929Z","severity":{"score":6.6,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","source":"dell"},"assigner":"dell","products":["Dell RecoverPoint for VMs"],"affected":[{"vendor":"Dell","product":"RecoverPoint for VMs","defaultStatus":"unaffected","versions":[{"version":"6.0 SP1","status":"affected"},{"version":"6.0 SP1 P1","status":"affected"},{"version":"6.0 SP1 P2","status":"affected"}]}],"references":["https://www.dell.com/support/kbdoc/en-us/000287503/dsa-2025-101-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-component-vulnerabilities"],"weaknesses":["CWE-284"],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/21xxx/CVE-2025-21105.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-21105","state":"PUBLISHED","datePublished":"2025-02-20T12:10:15.653Z","dateUpdated":"2025-02-20T13:59:59.929Z","assignerShortName":"dell","assignerOrgId":"c550e75a-17ff-4988-97f0-544cde3820fe","dateReserved":"2024-11-22T06:42:03.817Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Dell RecoverPoint for Virtual Machines 6.0.X contains a command execution vulnerability. A Low privileged malicious user with local access could potentially exploit this vulnerability by running the specific binary and perform any administrative action permitted by it resulting in shutting down the server, modifying the configuration leading to gain access to unauthorized data."}],"affected":[{"vendor":"Dell","product":"RecoverPoint for VMs","defaultStatus":"unaffected","versions":[{"version":"6.0 SP1","status":"affected"},{"version":"6.0 SP1 P1","status":"affected"},{"version":"6.0 SP1 P2","status":"affected"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000287503/dsa-2025-101-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-component-vulnerabilities","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":6.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","description":"CWE-284: Improper Access Control","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"dell","orgId":"c550e75a-17ff-4988-97f0-544cde3820fe","dateUpdated":"2025-02-20T12:10:15.653Z"},"datePublic":"2025-02-19T18:30:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-20T13:58:06.583600Z","id":"CVE-2025-21105","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-20T13:59:59.929Z"}}]}}}