CVE-2025-66237

MediumCVSS 6.7/10Last modified Sep 25, 2026

Description

DCIM dcTrack platforms utilize default and hard-coded credentials for access. An attacker could use these credentials to administer the database, escalate privileges on the platform or execute system commands on the host.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

VendorProductVersions
SunbirdDCIM dcTrack<= v9.2.0
SunbirdPower IQ<= v9.2.0

References

Timeline

Published
Dec 4, 2025
Last modified
Sep 25, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-662387.2DCIM dcTrack allows an attacker to misuse certain remote access features. An authenticated user with access to the appliance's virtual consoCVE-2025-66247.2Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debugCVE-2025-662496.3Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Livy. This issue affects Apache LivyCVE-2025-66257.5CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to theCVE-2025-662509.8Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50CVE-2025-662519.1Unauthenticated Path Traversal with Arbitrary File Deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50CVE-2025-662527.5Infinite Loop Denial of Service via Failed File Deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 1CVE-2025-662539.8Unauthenticated OS Command Injection (start_upgrade.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 1CVE-2025-662549.1Unauthenticated Arbitrary File Deletion (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30,CVE-2025-662559.8Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 5CVE-2025-662569.8Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50,CVE-2025-662579.1Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 5
CVE-2025-66237: Medium severity, CVSS 6.7 | Vulnix