CVE-2025-22472: Dell SmartFabric OS10 Privilege Escalation

CVE-2025-22472 Overview

CVE-2025-22472 is a command injection vulnerability affecting Dell SmartFabric OS10 Software. The flaw resides in versions 10.5.4.x, 10.5.5.x, 10.5.6.x, and 10.6.0.x. A low-privileged attacker with local access to an affected switch can inject shell metacharacters into vulnerable command handlers. Successful exploitation executes arbitrary commands with elevated privileges on the network operating system. The weakness is classified under CWE-77: Improper Neutralization of Special Elements used in a Command.

Critical Impact
An authenticated local attacker can escalate privileges and execute arbitrary commands on Dell SmartFabric OS10 switches, compromising confidentiality, integrity, and availability of the network fabric.

Affected Products

Dell SmartFabric OS10 versions 10.5.4.x
Dell SmartFabric OS10 versions 10.5.5.x and 10.5.6.x
Dell SmartFabric OS10 versions 10.6.0.x

Discovery Timeline

2025-03-17 - CVE-2025-22472 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22472

Vulnerability Analysis

Dell SmartFabric OS10 is the network operating system that powers Dell PowerSwitch data center switches. The vulnerability stems from improper neutralization of special elements passed to a command interpreter. A local user with limited shell or CLI privileges can supply crafted input containing shell metacharacters such as ;, |, backticks, or $(). The affected command handler passes this input into a system call without adequate sanitization. The injected commands then execute in the context of a privileged process, allowing the attacker to break out of the restricted CLI and gain elevated privileges on the switch.

Root Cause

The root cause is improper input validation in a privileged OS10 command handler. User-controlled arguments are concatenated into a command string executed by a shell or system()-style call. Because special characters are not filtered, escaped, or passed as separate arguments, an attacker can terminate the intended command and append arbitrary payloads. This pattern is characteristic of [CWE-77] command injection flaws.

Attack Vector

The attack requires local access and low-level authenticated privileges on the switch. Access typically comes through the console, SSH into the OS10 CLI, or an already-compromised low-privileged account. The attacker invokes the vulnerable command with a crafted argument that embeds shell metacharacters. Because Dell has not published exploit details and no public proof-of-concept exists at time of writing, network operators should assume any authenticated CLI user is a potential attacker until switches are patched. See the Dell Security Advisory DSA-2025-070 for vendor guidance.

No verified proof-of-concept code is publicly available for CVE-2025-22472.
Refer to Dell security advisories for authoritative technical details.

Detection Methods for CVE-2025-22472

Indicators of Compromise

Unexpected child processes spawned by OS10 management daemons or CLI handler processes on affected switches.
Shell command history entries containing metacharacters such as ;, |, &&, backticks, or $() appended to legitimate OS10 CLI commands.
New or modified files in privileged system directories following execution of CLI commands by non-admin users.
Unexplained privilege transitions in OS10 audit logs where a low-privileged account performs administrative actions.

Detection Strategies

Enable and forward OS10 audit logs and AAA command accounting to a central SIEM for correlation across the switching fabric.
Alert on CLI commands issued by non-admin users that contain shell metacharacters or that immediately precede privilege-escalation events.
Monitor SSH and console session telemetry for authenticated users executing diagnostic or maintenance commands with unusual argument patterns.

Monitoring Recommendations

Baseline normal CLI usage per role and alert on deviations, especially command invocations with embedded special characters.
Track configuration changes to aaa, user role bindings, and RBAC profiles on OS10 switches.
Correlate switch audit events with endpoint and identity telemetry to identify pivoting from compromised jump hosts to network infrastructure.

How to Mitigate CVE-2025-22472

Immediate Actions Required

Inventory all Dell PowerSwitch devices running SmartFabric OS10 and identify systems on 10.5.4.x, 10.5.5.x, 10.5.6.x, or 10.6.0.x.
Apply the fixed OS10 releases referenced in the Dell security advisories as soon as change windows allow.
Restrict CLI and SSH access to the switch management plane to a small set of trusted administrators and jump hosts.
Rotate credentials for any low-privileged OS10 accounts and remove unused local users.

Patch Information

Dell has released fixed versions of SmartFabric OS10 through multiple advisories. Consult the following resources for exact fixed builds and upgrade guidance:

Workarounds

Enforce role-based access control so only vetted administrators can reach the OS10 CLI.
Place the switch management interfaces on an isolated out-of-band management VLAN with strict ACLs.
Require multi-factor authentication on bastion hosts used to reach switch management planes.
Enable AAA command authorization and command accounting to constrain and record CLI activity until patching completes.

bash

# Example: restrict management access and enable command accounting on OS10
configure terminal
interface mgmt 1/1/1
  ip access-group MGMT_ACL in
exit
ip access-list MGMT_ACL
  permit ip 10.10.0.0/24 any
  deny   ip any any log
exit
aaa accounting commands all default start-stop group tacacs+
end
write memory