PT-2025-7538 · Dell · Dell Recoverpoint For Virtual Machines

Published 2025-02-20 · Updated 2025-07-31 · CVE-2025-21105

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell RecoverPoint for Virtual Machines version 6.0.X

Description A command execution vulnerability exists, allowing a low-privileged malicious user with local access to potentially exploit it by running a specific binary. This could result in shutting down the server, modifying the configuration, and gaining access to unauthorized data.

Recommendations For version 6.0.X, consider restricting access to the specific binary that can be exploited to minimize the risk of unauthorized actions until a patch is available. As a temporary workaround, limit administrative actions permitted by the binary to prevent potential configuration modifications and unauthorized data access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2025-06369

CVE-2025-21105

Affected Products

Dell Recoverpoint For Virtual Machines

References · 8

• https://dell.com/support/kbdoc/en-us/000287503/dsa-2025-101-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-component-vulnerabilities · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06369 · Security Note
• https://osv.dev/vulnerability/CVE-2025-21105 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21105 · Security Note
• https://t.me/cvedetector/18537 · Telegram Post
• https://twitter.com/CVEnew/status/1892559799813837303 · Twitter Post
• https://t.me/cveNotify/130431 · Telegram Post
• https://t.me/cvenotify/111869 · Telegram Post