CVE-2025-21107
📋 TL;DR
This CVE describes an unquoted search path vulnerability in Dell NetWorker that allows local attackers with low privileges to execute arbitrary code. Attackers could place malicious executables in paths that get executed due to improper path quoting. All Dell NetWorker installations prior to version 19.11.0.3 and all versions of 19.10 are affected.
💻 Affected Systems
- Dell NetWorker
- Dell NetWorker Virtual Edition
- Dell NetWorker Management Console
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining SYSTEM/root privileges, installing persistent backdoors, and pivoting to other systems in the network.
Likely Case
Local privilege escalation leading to data theft, credential harvesting, and lateral movement within the environment.
If Mitigated
Limited impact due to proper access controls, monitoring, and network segmentation preventing lateral movement.
🎯 Exploit Status
Requires local access and low privileges. Attackers need to understand the specific unquoted paths and have write access to parent directories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 19.11.0.3 or later
Restart Required: No
Instructions:
1. Download the latest NetWorker update from Dell Support. 2. Apply the patch following Dell's installation guide. 3. Verify the version is 19.11.0.3 or later.
🔧 Temporary Workarounds
Restrict write permissions to vulnerable directories
allRemove write permissions for low-privileged users from directories that could be used in the unquoted search path attack
icacls "C:\Program Files\NetWorker\" /deny Users:(OI)(CI)W
chmod -R o-w /usr/local/networker/
Implement application whitelisting
windowsUse Windows AppLocker or similar solutions to restrict execution to authorized binaries only
🧯 If You Can't Patch
- Implement strict access controls to limit local user access to NetWorker systems
- Monitor for suspicious process creation and file writes in NetWorker directories
🔍 How to Verify
Check if Vulnerable:
Check NetWorker version via command line: 'nsr_render_log' or check installed version in Control Panel/Add Remove ProgramsCheck Version:
nsr_render_log -vVerify Fix Applied:
Verify version is 19.11.0.3 or later using the same version check methods📡 Detection & Monitoring
Log Indicators:
- Unexpected process execution from NetWorker directories
- Failed privilege escalation attempts in Windows Event Logs
- File creation in system directories by non-admin users
Network Indicators:
- Unusual outbound connections from NetWorker servers
- Lateral movement attempts from NetWorker systems
SIEM Query:
source="windows_security" EventCode=4688 ProcessName="*NetWorker*" OR source="sysmon" EventID=1 Image="*NetWorker*"