CVE-2025-22397: Dell iDRAC Path Traversal Vulnerability

CVE-2025-22397 Overview

CVE-2025-22397 is a path traversal vulnerability affecting Dell Integrated Dell Remote Access Controller (iDRAC) firmware. The flaw resides in iDRAC9 firmware for 14G servers prior to 7.00.00.181, iDRAC9 for 15G and 16G platforms running 6.10.80.00 through 7.20.10.50, and iDRAC10 (17G) firmware prior to 1.20.25.00. An authenticated attacker with high privileges and remote network access can traverse outside restricted directories to read unauthorized files on the baseboard management controller. The weakness is categorized under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
A remote, high-privileged attacker can read files outside the intended directory scope on the iDRAC management controller, exposing sensitive configuration data.

Affected Products

Dell iDRAC9 firmware, 14G servers, versions prior to 7.00.00.181
Dell iDRAC9 firmware, 15G and 16G servers, versions 6.10.80.00 through 7.20.10.50
Dell iDRAC10 firmware, 17G servers, versions prior to 1.20.25.00

Discovery Timeline

2025-11-06 - CVE-2025-22397 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22397

Vulnerability Analysis

The iDRAC is Dell's out-of-band server management processor, providing remote console, virtual media, and lifecycle controller functions. Because iDRAC operates independently of the host operating system, any file exposure on the controller can leak credentials, certificates, and configuration secrets used to manage the physical server.

CVE-2025-22397 permits an authenticated administrator-level session to submit crafted pathname input that escapes the directory boundaries enforced by the iDRAC web or API layer. The vulnerability affects confidentiality only; integrity and availability remain intact per the published vector. Because the attack surface is the management interface, exploitation is network-reachable and does not require user interaction.

The EPSS probability for CVE-2025-22397 is 0.43%, reflecting the high-privilege precondition that limits opportunistic exploitation.

Root Cause

The root cause is insufficient normalization and validation of user-supplied path components before file system access on the iDRAC firmware. Sequences such as ../ or absolute path fragments are not stripped or rejected, allowing the request handler to resolve paths outside the intended directory root.

Attack Vector

An attacker authenticates to iDRAC with a high-privilege account and then issues requests containing traversal sequences to management endpoints that accept file or resource identifiers. The server resolves the manipulated path and returns file contents from unauthorized directories. See the Dell Security Update for iDRAC9 and iDRAC10 for the vendor description.

No verified proof-of-concept code has been published for this issue.

Detection Methods for CVE-2025-22397

Indicators of Compromise

iDRAC audit log entries showing administrative HTTP or Redfish requests containing .., %2e%2e, or encoded path separators.
Unexpected file-read responses returning content from directories outside standard iDRAC web roots.
Successful high-privilege logins from unfamiliar management network sources shortly followed by unusual API calls.

Detection Strategies

Enable iDRAC verbose logging and forward Lifecycle Controller logs to a central log aggregator for signature and anomaly review.
Inspect Redfish API traffic on TCP 443 for path parameters containing traversal patterns.
Correlate management-plane authentications with subsequent bulk file or configuration retrieval events.

Monitoring Recommendations

Monitor iDRAC firmware versions across the fleet and flag hosts still running affected builds.
Alert on new or modified iDRAC administrator accounts, which are the precondition for exploitation.
Restrict and log access to the dedicated management VLAN carrying iDRAC traffic.

How to Mitigate CVE-2025-22397

Immediate Actions Required

Upgrade iDRAC9 14G firmware to 7.00.00.181 or later.
Upgrade iDRAC9 15G and 16G firmware to a version above 7.20.10.50 as specified by Dell.
Upgrade iDRAC10 17G firmware to 1.20.25.00 or later.
Rotate iDRAC administrator credentials and audit privileged account membership after patching.

Patch Information

Dell has released fixed firmware for all affected iDRAC generations. Refer to DSA-2025-376: Dell Security Update for iDRAC9 and iDRAC10 for download links and applicability details. Apply firmware updates using Dell's Lifecycle Controller, Integrated Remote Access Controller UI, or Redfish API.

Workarounds

Isolate iDRAC interfaces on a dedicated out-of-band management network with strict ACLs.
Enforce multi-factor authentication and least-privilege role assignment for iDRAC accounts to limit the pool of users meeting the high-privilege precondition.
Disable unused iDRAC services and interfaces such as legacy IPMI-over-LAN where not required.

bash

# Example: query current iDRAC firmware version via Redfish before and after patching
curl -sk -u admin:'<password>' \
  https://<idrac-host>/redfish/v1/Managers/iDRAC.Embedded.1 \
  | jq '.FirmwareVersion'