CVE-2025-21103: Dell NetWorker RCE Vulnerability

CVE-2025-21103 Overview

CVE-2025-21103 affects Dell NetWorker Management Console (NMC), the centralized management interface for Dell's enterprise backup and recovery product. The vulnerability stems from improper neutralization of server-side input [CWE-97], allowing an unauthenticated attacker with local access to run arbitrary code on the server.

Dell published the advisory on February 17, 2025. Affected versions include 19.11 through 19.11.0.3 and all releases prior to 19.10.0.7. Exploitation requires user interaction but no privileges, increasing the risk in environments where administrators interact with untrusted content through the console.

Critical Impact
An attacker can execute arbitrary code on the NetWorker server, compromising backup integrity and gaining a pivot point into protected enterprise data stores.

Affected Products

Dell NetWorker Management Console 19.11 through 19.11.0.3
Dell NetWorker Management Console versions prior to 19.10.0.7
Dell NetWorker deployments relying on NMC for centralized backup administration

Discovery Timeline

2025-02-17 - CVE-2025-21103 published to NVD
2025-02-17 - Dell releases DSA-2025-095 security advisory and patched versions
2025-12-06 - Last updated in NVD database

Technical Details for CVE-2025-21103

Vulnerability Analysis

The flaw is classified under [CWE-97] Improper Neutralization of Server-Side Includes. The Dell NetWorker Management Console fails to properly sanitize directives processed on the server side before rendering or evaluating them. When user-controlled input reaches a server-side include or template parser without neutralization, the parser interprets attacker-supplied content as executable directives instead of inert data.

The attacker must have local access to the system and requires user interaction to trigger the unsafe parsing path. Successful exploitation results in arbitrary code execution in the context of the NMC service, with consequences across confidentiality, integrity, and availability.

Because NetWorker centrally manages backup jobs, credentials, and storage targets, code execution on the management console provides downstream access to backup data, recovery operations, and the credentials NMC uses to communicate with storage nodes and clients.

Root Cause

The root cause is missing or insufficient neutralization of server-side include syntax in input processed by the NetWorker Management Console. Input destined for template or include processing is not escaped or validated against an allow-list of acceptable tokens, so injected directives are evaluated by the server.

Attack Vector

The attack vector is local with low complexity. An attacker stages malicious content that, when opened or processed by a user interacting with NMC, is parsed server-side. The directive then triggers execution of attacker-controlled commands within the NetWorker service context. See the Dell Security Update Advisory for vendor-confirmed exploitation prerequisites.

Detection Methods for CVE-2025-21103

Indicators of Compromise

Unexpected child processes spawned by the NetWorker Management Console service (nsrexecd, gstd, or related Java/Tomcat processes).
New or modified files under NMC installation directories with timestamps that do not align with patching or operator activity.
Outbound network connections from the NMC host to unfamiliar destinations following local user interaction with console content.

Detection Strategies

Monitor process lineage from NMC services for shell interpreters (cmd.exe, powershell.exe, /bin/sh, /bin/bash) and scripting engines.
Inspect NMC and Tomcat logs for malformed or unusual include directives, template tokens, or encoded payloads in submitted parameters.
Establish a behavioral baseline for the NMC service account and alert on deviations such as new file writes outside expected directories.

Monitoring Recommendations

Forward NMC application, Tomcat, and host audit logs to a centralized SIEM for correlation against process telemetry.
Enable EDR coverage on all NetWorker management hosts to capture process creation, file writes, and network connections.
Review scheduled backup job definitions and credential stores for unauthorized modification on a recurring cadence.

How to Mitigate CVE-2025-21103

Immediate Actions Required

Inventory all Dell NetWorker Management Console instances and identify those running 19.11 through 19.11.0.3 or any release before 19.10.0.7.
Apply the Dell-supplied fixed versions referenced in DSA-2025-095 as the primary remediation.
Restrict local interactive logon to the NMC server to a minimal set of administrative accounts.
Educate administrators against opening untrusted files or content within the management console.

Patch Information

Dell addressed CVE-2025-21103 in DSA-2025-095. Customers should upgrade to the fixed releases identified in the Dell Security Update Advisory. Versions 19.10.0.7 and later in the 19.10 branch, and the post-19.11.0.3 fixed release in the 19.11 branch, contain the remediation.

Workarounds

Limit access to the NMC host through network segmentation and host-based firewall rules until patching completes.
Disable or restrict non-essential local accounts on the NetWorker management server.
Require multi-factor authentication on all administrative accounts that can reach the NMC host.

bash

# Confirm installed Dell NetWorker version on Linux
rpm -qa | grep -i lgto | grep -i nmc

# Confirm installed Dell NetWorker version on Windows (PowerShell)
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like '*NetWorker Management Console*' } | Select-Object Name, Version