CVE-2025-21107: Dell NetWorker RCE Vulnerability

CVE-2025-21107 Overview

CVE-2025-21107 is an unquoted search path vulnerability affecting Dell NetWorker. The flaw exists in Dell NetWorker versions prior to 19.11.0.3 and all versions of 19.10 and earlier. A local attacker with low privileges can exploit this weakness to execute arbitrary code with elevated privileges. The issue is tracked under CWE-428 and carries a CVSS score of 7.8.

Critical Impact
A low-privileged local user can plant a malicious executable in an unquoted service path, achieving code execution with the privileges of the NetWorker service account.

Affected Products

Dell NetWorker versions prior to 19.11.0.3
Dell NetWorker 19.10 and all prior versions
Deployments on Microsoft Windows and Linux hosts

Discovery Timeline

2025-01-30 - CVE-2025-21107 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21107

Vulnerability Analysis

The vulnerability stems from an unquoted search path or element in Dell NetWorker installation components. When Windows encounters a service path that contains spaces and lacks surrounding quotation marks, the operating system attempts to execute each whitespace-delimited token as a candidate binary. An attacker who can write to any directory earlier in the resolved path can place a malicious executable that Windows loads in place of the intended NetWorker binary.

The result is arbitrary code execution in the context of the service, which typically runs with SYSTEM or an equivalent privileged account. This delivers a direct privilege escalation from a standard local user to a highly privileged service identity. The EPSS score is 0.198%, indicating a low probability of near-term mass exploitation, but targeted abuse in enterprise backup environments remains realistic.

Root Cause

Dell NetWorker registers one or more Windows services with executable paths that contain unquoted whitespace. Combined with weak filesystem permissions on parent directories in the search path, this allows privilege escalation via file planting. The weakness is classified as CWE-428: Unquoted Search Path or Element.

Attack Vector

Exploitation requires local access and low-privileged credentials on a host running a vulnerable NetWorker installation. The attacker identifies a service with an unquoted binary path, verifies write access to a directory earlier in the resolution order, and drops a payload named to match the intercepted path token. When the service restarts or the host reboots, Windows executes the attacker's binary with the service account's privileges.

See the Dell Security Advisory DSA-2025-064 for vendor technical detail. No public proof-of-concept exploit code is currently available for this CVE.

Detection Methods for CVE-2025-21107

Indicators of Compromise

Unexpected executable files present in directories along an unquoted service path such as C:\Program Files\ or intermediate NetWorker install directories.
New or modified child processes spawned by the NetWorker service account outside of scheduled backup windows.
Service restarts followed by process launches from non-standard file paths.

Detection Strategies

Enumerate Windows services with wmic service get name,pathname and flag any NetWorker service whose pathname contains spaces without surrounding quotes.
Audit filesystem access control lists on all directories referenced in NetWorker service paths for write permissions granted to non-administrative users.
Correlate service start events (Windows Event ID 7036) with process creation events (Event ID 4688) to detect execution of unexpected binaries.

Monitoring Recommendations

Enable command-line auditing and process creation logging on all NetWorker hosts.
Alert on file writes by low-privileged accounts to directories referenced by service binary paths.
Track service configuration changes to NetWorker components using the Windows Service Control Manager event log.

How to Mitigate CVE-2025-21107

Immediate Actions Required

Upgrade Dell NetWorker to version 19.11.0.3 or later as directed by DSA-2025-064.
Inventory all NetWorker installations, including NetWorker Virtual Edition and NetWorker Management Console, and validate patch status.
Restrict interactive logon on NetWorker servers to administrative personnel only.

Patch Information

Dell has released fixed builds in Dell NetWorker 19.11.0.3. Customers on the 19.10 branch and all prior versions must upgrade to the fixed release. Refer to the Dell Security Update DSA-2025-064 for the complete remediation matrix.

Workarounds

Manually correct affected service registrations by quoting the full ImagePath value using sc config <ServiceName> binPath= "\"C:\Path With Spaces\service.exe\"".
Remove write permissions for standard users on any parent directory referenced by a NetWorker service path.
Restrict local logon on backup infrastructure to reduce the number of accounts capable of staging the required payload.

bash

# Configuration example: identify unquoted service paths on Windows
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "\"" | findstr /i /v "C:\\Windows\\"