Dell iDRAC9 and iDRAC10 Path Traversal (CVE-2025-22397)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505075);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/09");

  script_cve_id("CVE-2025-22397");

  script_name(english:"Dell iDRAC9 and iDRAC10 Path Traversal (CVE-2025-22397)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Dell Integrated Dell Remote Access Controller 9, 14G versions prior to
7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and
Dell Integrated Dell Remote Access Controller 10, 17G versions prior
to 1.20.25.00, contain an Improper Limitation of a Pathname to a
Restricted Directory ('Path Traversal') vulnerability. A high
privileged attacker with remote access could potentially exploit this
vulnerability, leading to Unauthorized access.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.dell.com/support/kbdoc/en-us/000384516/dsa-2025-376-security-update-for-dell-idrac9-and-idrac10-vulnerabilities
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cf916a89");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:M/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-22397");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(22);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/11/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dell:idrac9_14g_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dell:idrac9_15g_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dell:idrac9_16g_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dell:idrac10_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Dell");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Dell');

var asset = tenable_ot::assets::get(vendor:'Dell');

var vuln_cpes = {
    "cpe:/o:dell:idrac9_14g_firmware" :
        {"versionEndExcluding" : "7.00.00.181", "family" : "iDRAC9"},
    "cpe:/o:dell:idrac9_15g_firmware" :
        {"versionEndExcluding" : "7.20.10.50", "versionStartIncluding" : "6.10.80.00", "family" : "iDRAC9"},
    "cpe:/o:dell:idrac9_16g_firmware" :
        {"versionEndExcluding" : "7.20.10.50", "versionStartIncluding" : "6.10.80.00", "family" : "iDRAC9"},
    "cpe:/o:dell:idrac10_firmware" :
        {"versionEndExcluding" : "1.20.25.00", "family" : "iDRAC10"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);