CVE-2025-22399 Overview
CVE-2025-22399 is a Blind Server-Side Request Forgery (SSRF) vulnerability affecting Dell Utility Configuration Collector (UCC) Edge version 2.3.0. The flaw resides in the Add Customer SFTP Server functionality. An attacker with local access and low privileges can coerce the application into issuing arbitrary outbound requests. Successful exploitation can compromise the confidentiality, integrity, and availability of the host. The issue is tracked under CWE-918: Server-Side Request Forgery and was addressed by Dell in advisory DSA-2025-043.
Critical Impact
A local authenticated attacker can abuse the SFTP server configuration workflow to force the application to reach internal network resources, potentially pivoting to internal services.
Affected Products
- Dell Utility Configuration Collector (UCC) Edge version 2.3.0
Discovery Timeline
- 2025-02-11 - CVE-2025-22399 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-22399
Vulnerability Analysis
Dell UCC Edge is a utility used for collecting configuration data from customer environments. The Add Customer SFTP Server feature accepts a server destination as user input. The application then initiates a connection to that destination without adequately validating the target. This behavior enables Blind SSRF, where the attacker cannot directly observe the response but can still trigger requests to arbitrary hosts and ports.
Because the vulnerability is blind, exploitation typically relies on out-of-band techniques or observable side effects such as timing differences. The attacker can enumerate internal hosts, probe cloud metadata endpoints, or interact with internal management interfaces exposed only on the local network.
Root Cause
The root cause is missing or insufficient validation of user-supplied server destinations in the SFTP server registration workflow. The application trusts input intended to specify a legitimate SFTP endpoint and does not enforce allowlists, protocol restrictions, or network-segment boundaries before initiating the outbound connection.
Attack Vector
Exploitation requires local access to the UCC Edge host and low-privilege authentication to the application. The attacker submits a crafted SFTP server entry pointing to an internal target rather than a legitimate SFTP endpoint. The application then reaches that target on behalf of the attacker. No user interaction is required beyond the attacker's own authenticated submission.
No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-22399
Indicators of Compromise
- Unexpected outbound connections from the UCC Edge host to internal IP ranges, cloud metadata endpoints (169.254.169.254), or non-SFTP ports.
- Application logs recording SFTP server additions with unusual hostnames, IP literals, or non-standard ports.
- Repeated failed SFTP connection attempts originating from the UCC Edge process, indicative of internal host enumeration.
Detection Strategies
- Correlate UCC Edge application logs with host network telemetry to identify SFTP configuration entries followed by connections to non-SFTP destinations.
- Baseline legitimate SFTP destinations used by administrators and alert on deviations, including new IP ranges or metadata endpoints.
- Inspect authentication logs on the UCC Edge host for low-privilege accounts performing SFTP server administration actions outside expected change windows.
Monitoring Recommendations
- Enable verbose logging on the UCC Edge Add Customer SFTP Server workflow and forward logs to a centralized SIEM for retention and correlation.
- Monitor egress traffic from the UCC Edge host with network segmentation controls that restrict outbound destinations to approved SFTP servers.
- Track privileged and low-privileged user activity on the host operating system to identify unauthorized configuration changes.
How to Mitigate CVE-2025-22399
Immediate Actions Required
- Apply the fixed version of Dell UCC Edge as documented in Dell Security Update DSA-2025-043.
- Restrict local access to the UCC Edge host to authorized administrators only.
- Review recent SFTP server configuration entries for suspicious destinations and remove any that are not legitimate.
Patch Information
Dell has released a security update addressing this vulnerability along with other issues in the same advisory. Refer to Dell Security Update DSA-2025-043 for the fixed version and upgrade instructions.
Workarounds
- Enforce network egress filtering on the UCC Edge host so that outbound traffic is limited to a defined allowlist of legitimate SFTP servers.
- Limit account provisioning on the UCC Edge application and require multi-factor authentication for local access to the host.
- Segment the UCC Edge host from sensitive internal management networks and cloud metadata services to reduce the impact of SSRF requests.
# Configuration example: restrict egress from UCC Edge host to approved SFTP destinations
# Replace <approved-sftp-ip> with the legitimate SFTP server address(es)
iptables -A OUTPUT -p tcp -d <approved-sftp-ip> --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 22 -j DROP
iptables -A OUTPUT -d 169.254.169.254 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
