CVE-2025-66238CWE-288

Sunbird DCIM dcTrack and Power IQ Authentication Bypass Using an Alternate Path or Channel

High · published December 4, 2025

CVSS v4.0
7.4
EPSS
0%
Percentile
26.4
In the wild
Unconfirmed
What it is

⚡ An authenticated user can misuse remote access features to redirect network traffic — think of it as giving someone the power to reroute an entire delivery system with just a few keystrokes! Imagine a restaurant where the staff can not only serve food but also sneak into the kitchen to change orders. This vulnerability allows an authenticated user to manipulate network traffic like a waiter swapping out dishes without the kitchen's knowledge. This means a malicious insider could access restricted services or sensitive data on the host machine, leading to potentially catastrophic data leaks and unauthorized access. If exploited, it could compromise the integrity and confidentiality of your data — a true recipe for disaster!

Put simply

Imagine a restaurant where the staff can not only serve food but also sneak into the kitchen to change orders. This vulnerability allows an authenticated user to manipulate network traffic like a waiter swapping out dishes without the kitchen's knowledge. The vulnerability exists in DCIM dcTrack, where an authenticated user with access to the virtual console can exploit remote access features to redirect network traffic and access restricted areas.

What to do

This means a malicious insider could access restricted services or sensitive data on the host machine, leading to potentially catastrophic data leaks and unauthorized access. If exploited, it could compromise the integrity and confidentiality of your data — a true recipe for disaster! To address this issue, restrict access to the virtual console to only necessary personnel, review and apply the latest security patches from the vendor, and conduct an audit of user permissions. It's essential to ensure that only trusted users can access sensitive features. You've got this! With these steps, you'll shore up your defenses and keep your network safe and sound! 🛡️

The record
Technical detail
CVSS v4.0
7.4 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00342 · 26.4th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2025-12-04T21:10Z
EPSS history
Timeline
  • 04 DEC 21:10Z
    Sunbird DCIM dcTrack and Power IQ Authentication Bypass Using an Alternate Path or Channel
    cvelistv5