Listen to this Post
How CVE-2025-22472 Works
The vulnerability in Dell SmartFabric OS10 (versions 10.5.4.x to 10.6.0.x) stems from improper sanitization of user-supplied input in command execution functions. A local attacker with low privileges can inject malicious commands through crafted input, which the system executes with elevated privileges due to insufficient input validation. This command injection flaw allows bypassing restricted shells or permission checks, leading to full system compromise. The exploit leverages OS10’s failure to neutralize special characters (e.g., ;, &, |) in CLI or API parameters, enabling arbitrary command execution under root context.
DailyCVE Form
Platform: Dell SmartFabric OS10
Version: 10.5.4.x – 10.6.0.x
Vulnerability: Command Injection
Severity: Critical
Date: 07/14/2025
Prediction: Patch by 09/2025
What Undercode Say
Check OS10 version show version Exploit PoC (simulated) curl -X POST --data "cmd=;id" http://target/cli Mitigation test grep -r "sanitize_input" /opt/dell/os10/bin
How Exploit
1. Attacker gains local low-privilege access.
2. Injects malicious payload via CLI/API parameter.
3. System executes payload with root privileges.
Protection from this CVE
1. Apply Dell patches (when released).
2. Restrict local access.
3. Implement input sanitization.
Impact
- Full system compromise.
- Privilege escalation.
- Unauthorized command execution.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
