CVE-2025-45378

Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell. A Privileged user with known password can break into command shell of CloudLink server and gain access of shell and escalate privilege, gain unauthorized access of system. If ssh is enabled with web credentials of server, attack is possible through network with known privileged user/password.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000384363/dsa-2025-374-security-update-for-dell-cloudlink-multiple-security-vulnerabilities	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dell:cloudlink:*:*:*:*:*:*:*:*

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Dell CloudLink, versiones 8.0 a 8.1.2, contienen una vulnerabilidad en un shell restringido. Un usuario privilegiado con contraseña conocida puede irrumpir en el shell de comandos del servidor CloudLink y obtener acceso al shell, escalar privilegios y obtener acceso no autorizado al sistema. Si SSH está habilitado con las credenciales web del servidor, el ataque es posible a través de la red con un usuario/contraseña privilegiado conocido.

Information

Published : 2025-11-05 17:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-45378

Mitre link : CVE-2025-45378

CVE.ORG link : CVE-2025-45378

JSON object : View

Products Affected

dell

cloudlink

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-45378", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-45378", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-06T04:55:37.130318Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security_alert@emc.com", "affectedData": [{"vendor": "Dell", "product": "CloudLink", "versions": [{"status": "affected", "version": "8.0", "lessThan": "8.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-05T17:15:41.213", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000384363/dsa-2025-374-security-update-for-dell-cloudlink-multiple-security-vulnerabilities", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell. A Privileged user with known password can break into command shell of CloudLink server and gain access of shell and escalate privilege, gain unauthorized access of system.\n\nIf ssh is enabled with web credentials of server, attack is possible through network with known privileged user/password."}, {"lang": "es", "value": "Dell CloudLink, versiones 8.0 a 8.1.2, contienen una vulnerabilidad en un shell restringido. Un usuario privilegiado con contrase\u00f1a conocida puede irrumpir en el shell de comandos del servidor CloudLink y obtener acceso al shell, escalar privilegios y obtener acceso no autorizado al sistema.\n\nSi SSH est\u00e1 habilitado con las credenciales web del servidor, el ataque es posible a trav\u00e9s de la red con un usuario/contrase\u00f1a privilegiado conocido."}], "lastModified": "2026-10-18T21:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:cloudlink:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E35E706F-79EB-4658-8A92-DE070D649BA9", "versionEndIncluding": "8.1.2", "versionStartIncluding": "8.0"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}