PT-2025-4867 · Dell · Enterprise Sonic

Published 2025-01-29 · Updated 2025-02-07 · CVE-2025-23374

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell Networking Switches running Enterprise SONiC OS versions prior to 4.4.1 and 4.2.3

Description The issue concerns an Insertion of Sensitive Information into Log File, which could be exploited by a high privileged attacker with remote access, potentially leading to information exposure.

Recommendations For versions prior to 4.4.1, update to version 4.4.1 or later. For versions prior to 4.2.3, update to version 4.2.3 or later. As a temporary workaround, consider restricting access to log files to minimize the risk of exploitation.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2025-11356

CVE-2025-23374

Affected Products

Enterprise Sonic

References · 10

• https://dell.com/support/kbdoc/en-us/000278568/dsa-2025-057-security-update-for-dell-enterprise-sonic-distribution-vulnerability · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-23374 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11356 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-23374 · Security Note
• https://t.me/cvedetector/16743 · Telegram Post
• https://t.me/latest_high_impact_cve/1789 · Telegram Post
• https://twitter.com/BursaMatus/status/1884829212814549002 · Twitter Post
• https://t.me/cvenotify/109119 · Telegram Post
• https://twitter.com/dailycve/status/1887976652279599259 · Twitter Post
• https://twitter.com/CVEnew/status/1884822690361491854 · Twitter Post