CVE-2025-66237CWE-798hardcoded-credentials

CVE-2025-66237

Medium · published December 5, 2025

CVSS v3.1
6.7
EPSS
0%
Percentile
2.7
In the wild
Unconfirmed
What it is

DCIM dcTrack platforms utilize default and hard-coded credentials for access. An attacker could use these credentials to administer the database, escalate privileges on the platform or execute system commands on the host.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00134 · 2.7th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2025-12-05T02:16Z
References (2)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-338-05.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-25-338-05 · [email protected]
EPSS history
Timeline
  • 04 DEC 21:02Z
    Sunbird DCIM dcTrack and Power IQ Use of Hard-coded Credentials
    cvelistv5