CVE-2025-21105 Overview
CVE-2025-21105 is a command execution vulnerability affecting Dell RecoverPoint for Virtual Machines 6.0.X. A low-privileged local user can invoke a specific binary to perform administrative actions that should require higher privileges. Successful exploitation lets an attacker shut down the server, alter configuration, and access unauthorized data. The flaw is tracked under CWE-284: Improper Access Control and was published to the National Vulnerability Database (NVD) on February 20, 2025. Dell released a fix in security advisory DSA-2025-101.
Critical Impact
A local, low-privileged account can execute privileged administrative operations, leading to loss of confidentiality, integrity, and availability on the RecoverPoint for Virtual Machines appliance.
Affected Products
- Dell RecoverPoint for Virtual Machines 6.0 SP1
- Dell RecoverPoint for Virtual Machines 6.0 SP1 P1
- Dell RecoverPoint for Virtual Machines 6.0 SP1 P2
Discovery Timeline
- 2025-02-20 - CVE-2025-21105 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-21105
Vulnerability Analysis
The vulnerability resides in a binary shipped with Dell RecoverPoint for Virtual Machines 6.0.X that performs administrative operations without adequately validating the caller's privilege level. A user with only local, low-privileged shell access on the appliance can invoke this binary and inherit the elevated actions it permits. Because RecoverPoint for Virtual Machines governs replication and disaster-recovery workflows, unauthorized administrative control affects both data protection posture and business continuity. The classification under CWE-284 reflects an access-control gap rather than a memory-safety or injection flaw.
Root Cause
The root cause is improper access control on a privileged binary. The binary either runs with elevated permissions (for example via setuid or a service context) or interacts with a privileged component without verifying that the invoking user is authorized. Any local account that can reach the binary can trigger administrative operations it exposes.
Attack Vector
Exploitation requires local access to the RecoverPoint for Virtual Machines appliance and a valid low-privileged account. No user interaction is needed. Once authenticated, the attacker executes the vulnerable binary directly to shut down the server, modify configuration, or read data outside their authorization boundary. Public proof-of-concept code is not available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified exploit code is publicly available. See the Dell Security Update DSA-2025-101 advisory for vendor-supplied technical details.
Detection Methods for CVE-2025-21105
Indicators of Compromise
- Unexpected shutdowns or restarts of the RecoverPoint for Virtual Machines appliance initiated from a local session.
- Configuration changes to replication policies, journal settings, or user accounts that do not correlate with authorized change tickets.
- Execution of privileged appliance binaries by user contexts that normally have read-only or operator-level roles.
Detection Strategies
- Enable and forward appliance audit logs and shell command history to a central logging system for correlation.
- Alert on any invocation of administrative CLI utilities by non-administrator accounts.
- Baseline expected administrative activity per account and flag deviations, particularly outside of change windows.
Monitoring Recommendations
- Monitor SSH and console login events on the appliance, focusing on low-privileged service accounts.
- Track process execution telemetry on the underlying operating system, including parent-child process relationships involving the vulnerable binary.
- Review integrity of /etc and RecoverPoint configuration directories to detect unauthorized modifications.
How to Mitigate CVE-2025-21105
Immediate Actions Required
- Apply the fixed release referenced in Dell Security Update DSA-2025-101 to all Dell RecoverPoint for Virtual Machines 6.0.X deployments.
- Inventory all appliance user accounts and remove or disable any that are unused or overly permissioned.
- Restrict local and SSH access to the appliance to a minimal set of trusted administrators.
Patch Information
Dell has published remediation guidance in advisory DSA-2025-101. Administrators should upgrade to the fixed version identified in the Dell advisory and validate the deployment against Dell's post-upgrade checks.
Workarounds
- Where immediate patching is not possible, limit shell access to the appliance to administrators only and enforce jump-host access.
- Rotate credentials for all local accounts on the appliance and enforce strong authentication.
- Increase logging verbosity and forward events to a SIEM or data lake to detect abuse of the vulnerable binary until the patch is deployed.
# Verify installed RecoverPoint for Virtual Machines version
# Consult Dell DSA-2025-101 for the target fixed version string
get_version
# Review local accounts and remove unnecessary users
cat /etc/passwd
userdel <unused_account>
# Restrict SSH to administrative networks only (example)
# /etc/ssh/sshd_config
# AllowUsers admin@10.0.0.0/24
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
