CVE-2025-36609 Overview
Dell SmartFabric OS10 Software contains a hard-coded password vulnerability affecting versions prior to 10.6.0.5. A low-privileged local attacker can exploit the embedded credential to elevate privileges on the network operating system. The flaw is tracked under CWE-259: Use of Hard-coded Password. Dell published remediation guidance in advisory DSA-2025-259.
Critical Impact
Successful exploitation grants an authenticated local attacker full control over affected Dell networking switches, compromising the confidentiality, integrity, and availability of managed network infrastructure.
Affected Products
- Dell SmartFabric OS10 Software versions prior to 10.6.0.5
- Dell networking switches running vulnerable OS10 builds
- Dell PowerSwitch platforms managed via SmartFabric Services
Discovery Timeline
- 2025-07-30 - CVE-2025-36609 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-36609
Vulnerability Analysis
Dell SmartFabric OS10 ships with a password embedded in the software distribution. Any actor with knowledge of this credential and local access to the switch can authenticate against a privileged interface. The exploitation path requires the attacker to already hold low-level access on the device, such as a limited operator account or console session. Once authenticated with the hard-coded password, the attacker inherits elevated permissions that bypass normal role-based access controls.
The impact spans configuration tampering, credential exfiltration, and disruption of switching and routing functions. Because network operating systems sit at the core of data center fabrics, compromised switches enable lateral movement, traffic interception, and persistence across the connected environment.
Root Cause
The root cause is the presence of static credentials within the OS10 codebase or configuration, categorized under CWE-259. Hard-coded passwords cannot be rotated by administrators and are identical across all deployments of the affected firmware. Reverse engineering of the firmware image or leakage through support channels can expose the credential to attackers.
Attack Vector
Exploitation requires local access to the switch, which includes console connections, SSH sessions from an authenticated low-privileged user, or management-plane access through a jump host. The attacker submits the hard-coded credential to a privileged authentication interface exposed by OS10. No user interaction is required, and the attack complexity is low. The vulnerability affects Dell SmartFabric OS10 exclusively and does not require pre-existing administrative rights.
No public proof-of-concept or exploit code is available for CVE-2025-36609 at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-36609
Indicators of Compromise
- Unexpected authentication events on OS10 switches from local accounts followed by privilege escalation to admin or root roles.
- Configuration changes on Dell PowerSwitch devices that do not correlate with approved change tickets.
- New SSH keys, user accounts, or ACL modifications introduced outside change windows.
- Outbound connections from switch management interfaces to unknown external hosts.
Detection Strategies
- Enable and forward OS10 audit logs (show logging) to a centralized SIEM for correlation of authentication and privilege-change events.
- Baseline expected administrator sessions and alert on logins that use non-standard usernames or occur outside maintenance windows.
- Monitor for firmware version strings below 10.6.0.5 across the switch inventory to identify unpatched devices.
Monitoring Recommendations
- Aggregate switch syslog, AAA, and TACACS+/RADIUS accounting records into a central data lake for retention and correlation.
- Alert on any local authentication that bypasses centralized AAA on OS10 devices.
- Track configuration diffs between snapshots to identify unauthorized command execution on network fabric devices.
How to Mitigate CVE-2025-36609
Immediate Actions Required
- Upgrade Dell SmartFabric OS10 to version 10.6.0.5 or later on all affected switches per DSA-2025-259.
- Inventory all Dell PowerSwitch devices and confirm firmware versions before and after remediation.
- Restrict console and management-plane access to trusted operators and dedicated management networks only.
- Rotate all local switch account credentials and review AAA configurations after patching.
Patch Information
Dell released fixed firmware in Dell SmartFabric OS10 version 10.6.0.5. Consult the Dell Security Update DSA-2025-259 advisory for download links, upgrade prerequisites, and additional CVEs remediated in the same release.
Workarounds
- Isolate switch management interfaces on an out-of-band management VLAN accessible only to authorized administrators.
- Enforce access control lists on management ports to limit which hosts can reach SSH, HTTPS, and console services.
- Disable unused local accounts and require centralized authentication via TACACS+ or RADIUS where supported.
- Monitor privileged session activity closely until firmware upgrades are complete across the fleet.
# Verify OS10 version and upgrade to the fixed release
show version
# Copy the fixed image to the switch and install
copy scp://admin@10.0.0.10/images/PKGS_OS10-Enterprise-10.6.0.5.bin image://
install image://PKGS_OS10-Enterprise-10.6.0.5.bin
reload
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
