Medium severity · published Nov 6, 2025
CVE-2025-22397
Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell Remote Access…
4.9
CVSS
0.5%
EPSS
No
On KEV
Description
Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ID
Integrated Dell Remote Access Controller 10 17G version · Dell
before 1.20.25.00 · source: vendor
ID
Integrated Dell Remote Access Controller 9 14G Versions · Dell
before 7.00.00.181 · source: vendor
ID
Integrated Dell Remote Access Controller 9 15G and 16G versions · Dell
6.10.80.00 before 7.20.10.50 · source: vendor
IF
Idrac10 Firmware · Dell
before 1.20.25.00 · source: NVD
IF
Idrac9 Firmware · Dell
6.10.80.00 before 7.00.00.181; 7.00.00.183 before 7.20.10.50 · source: NVD
Affected product
ID
Integrated Dell Remote Access Controller 10 17G version
Dell