CVE-2025-21106
📋 TL;DR
Dell Recover Point for Virtual Machines 6.0.X has weak file system permissions that allow local low-privileged attackers to access non-sensitive resources. This vulnerability affects only systems running the vulnerable software version. The impact is limited to non-sensitive resources according to Dell's assessment.
💻 Affected Systems
- Dell Recover Point for Virtual Machines
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains unauthorized access to non-sensitive files, potentially leading to information disclosure or limited system manipulation.
Likely Case
Local user accesses files they shouldn't have permission to view, but only non-sensitive ones as described by Dell.
If Mitigated
Proper file permissions prevent unauthorized access, limiting impact to intended users only.
🎯 Exploit Status
Requires local access with low privileges. Exploitation involves accessing files with weak permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to version specified in DSA-2025-101
Restart Required: Yes
Instructions:
1. Review Dell advisory DSA-2025-101. 2. Download and apply the security update from Dell support. 3. Restart affected systems as required. 4. Verify the update was successful.
🔧 Temporary Workarounds
Manual permission hardening
linuxReview and tighten file system permissions on Dell Recover Point installation directories
Review current permissions: ls -la /path/to/recoverpoint/
Set appropriate permissions: chmod 750 /path/to/sensitive/directories/
Set proper ownership: chown root:root /path/to/sensitive/files/
🧯 If You Can't Patch
- Implement strict access controls to limit local user access to affected systems
- Monitor file access logs for unauthorized attempts to access Recover Point directories
🔍 How to Verify
Check if Vulnerable:
Check if running Dell Recover Point for Virtual Machines version 6.0.XCheck Version:
Check Dell Recover Point administration interface or documentation for version informationVerify Fix Applied:
Verify version has been updated beyond 6.0.X and check file permissions on installation directories📡 Detection & Monitoring
Log Indicators:
- Unauthorized file access attempts to Recover Point directories
- Permission change events on system files
Network Indicators:
- Not applicable - local vulnerability only
SIEM Query:
source="*" ("Recover Point" AND ("permission denied" OR "access denied")) OR (file_path CONTAINS "recoverpoint" AND action="read")