CVE-2025-46428CWE-77command-injection

CVE-2025-46428

High · published November 13, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
66.4
In the wild
Unconfirmed
What it is

🚨 A hidden command injection vulnerability in Dell SmartFabric OS10 could let a low-privileged attacker take control—think of it as a sneaky locksmith slipping in a master key! 🔑 Imagine a hotel where a guest can tamper with the electronic door locks with just a clever code. That’s what’s happening here! If an attacker knows the right commands, they could unlock the entire system and access sensitive data. With this vulnerability, an attacker could execute arbitrary code remotely, leading to unauthorized access—potentially devastating for your network. It's like handing over the keys to your castle to someone who shouldn’t even be on the guest list!

Put simply

Imagine a hotel where a guest can tamper with the electronic door locks with just a clever code. That’s what’s happening here! If an attacker knows the right commands, they could unlock the entire system and access sensitive data. This command injection flaw allows an attacker with low privileges to send malicious commands to the system, triggering execution of arbitrary code. The affected versions are Dell SmartFabric OS10 Software before 10.6.1.0, making it critical to take action.

What to do

With this vulnerability, an attacker could execute arbitrary code remotely, leading to unauthorized access—potentially devastating for your network. It's like handing over the keys to your castle to someone who shouldn’t even be on the guest list! To protect your systems, upgrade Dell SmartFabric OS10 Software to version 10.6.1.0 immediately. Additionally, review your access controls and monitor for any suspicious activities. Staying proactive is key! You've got this! Follow these steps, and your defenses will be stronger than ever! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01141 · 66.4th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2025-11-13T01:15Z
Affected products (1)
ProductVersionsFixed in
dell/smartfabric_os10< 10.6.1.010.6.1.0
References (1)
EPSS history
Timeline
  • 12 NOV 19:57Z
    Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection')…
    cvelistv5