PT-2025-12391 · Dell · Dell Chassis Management Controller Firmware

Published 2025-03-20 · Updated 2025-03-27 · CVE-2025-26336

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell Chassis Management Controller Firmware for Dell PowerEdge FX2 versions prior to 2.40.200.202101130302 Dell Chassis Management Controller Firmware for Dell PowerEdge VRTX versions prior to 3.41.200.202209300499

Description The issue is a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.

Recommendations For Dell Chassis Management Controller Firmware for Dell PowerEdge FX2 versions prior to 2.40.200.202101130302, update to version 2.40.200.202101130302 or later. For Dell Chassis Management Controller Firmware for Dell PowerEdge VRTX versions prior to 3.41.200.202209300499, update to version 3.41.200.202209300499 or later.

Fix

RCE

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

BDU:2025-03221

CVE-2025-26336

Affected Products

Dell Chassis Management Controller Firmware

References · 11

• https://osv.dev/vulnerability/CVE-2025-26336 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26336 · Security Note
• https://dell.com/support/kbdoc/en-us/000297463/dsa-2025-123-security-update-for-dell-chassis-management-controller-firmware-for-dell-poweredge-fx2-and-vrtx-vulnerabilities · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03221 · Security Note
• https://twitter.com/CveFindCom/status/1902918698064630015 · Twitter Post
• https://twitter.com/dailycve/status/1905303588533944661 · Twitter Post
• https://t.me/cvenotify/115612 · Telegram Post
• https://dell.com/support/kbdoc/ru-ru/000297463/dsa-2025-123-security-update-for-dell-chassis-management-controller-firmware-for-dell-poweredge-fx2-and-vrtx-vulnerabilities · Note
• https://twitter.com/VulmonFeeds/status/1903103749599490125 · Twitter Post
• https://t.me/cvedetector/20786 · Telegram Post
• https://twitter.com/CVEnew/status/1902930521878892874 · Twitter Post