Riskcovery

CVE-2025-66238

Sunbird DCIM dcTrack and Power IQ Authentication Bypass Using an Alternate Path or Channel

State
Published
Severity
7.4 High
Published
Dec 4, 2025
Updated
Dec 5, 2025
Reserved
Nov 25, 2025

Read the record on cve.org

Description

DCIM dcTrack allows an attacker to misuse certain remote access features. An authenticated user with access to the appliance's virtual console could exploit these features to redirect network traffic, potentially accessing restricted services or data on the host machine.

Scores

CVSSScoreVectorSource
4.07.4 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:Nicscert
3.17.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hicscert

Weaknesses

  • CWE-288 Authentication Bypass Using an Alternate Path or Channel

Affected Products

ProductVersions
DCIM dcTrackSunbird
  • v9.2.0 and earlierAffected
  • 9.2.3Not affected
IQSunbird
  • v9.2.0 and earlierAffected
  • 9.2.1Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.