CVE-2025-21104
📋 TL;DR
Dell NetWorker Management Console versions prior to 19.11.0.4 and version 19.12 contain an open redirect vulnerability that allows unauthenticated attackers to redirect users to malicious websites. This could enable phishing attacks to steal sensitive information. All users running affected versions are vulnerable.
💻 Affected Systems
- Dell NetWorker Management Console
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Successful phishing campaign leading to credential theft, financial loss, or malware installation on user systems.
Likely Case
Phishing attacks tricking users into revealing credentials or sensitive information via fake login pages.
If Mitigated
Limited impact with proper user awareness training and network segmentation preventing external access.
🎯 Exploit Status
Open redirect vulnerabilities typically require minimal technical skill to exploit once the vulnerable endpoint is identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 19.11.0.4 or later (excluding 19.12)
Restart Required: Yes
Instructions:
1. Download patch from Dell support portal. 2. Backup current configuration. 3. Apply patch following Dell documentation. 4. Restart NetWorker services. 5. Verify successful update.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict access to NetWorker Management Console to trusted IP addresses only
Web Application Firewall Rules
allConfigure WAF to block open redirect patterns and suspicious URL parameters
🧯 If You Can't Patch
- Isolate NetWorker Management Console to internal network only
- Implement strict user awareness training about phishing risks
🔍 How to Verify
Check if Vulnerable:
Check NetWorker version via Management Console interface or command lineCheck Version:
nsrwatch -V (on NetWorker server)Verify Fix Applied:
Verify version is 19.11.0.4 or later (not 19.12) and test redirect functionality📡 Detection & Monitoring
Log Indicators:
- Unusual redirect patterns in web server logs
- Multiple failed authentication attempts following redirects
Network Indicators:
- HTTP requests with suspicious redirect parameters to NetWorker console
SIEM Query:
source="networker_console" AND (url="*redirect=*" OR url="*url=*" OR url="*return=*")