Product:
CloudLink
Summary
Dell CloudLink, versions 8.0 through 8.1.2, contain a vulnerability on the restricted shell. A privileged user with a known password can break into the command shell of the CloudLink server, gaining unauthorized access and escalating privileges. If SSH is enabled with web credentials of the server, an attack is possible through the network with the known privileged user and password.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.1 | CVE-2025-45378 |
Exploitation
To exploit this vulnerability, an attacker must have access to a privileged user account with a known password. If SSH is enabled, the attacker can connect to the CloudLink server over the network and use the credentials to access the command shell. Once inside, the attacker can escalate privileges and gain unauthorized access to the system.
Affected Products
- CloudLink 8.0 – Contains the vulnerability allowing unauthorized access through the restricted shell.
- CloudLink 8.1 – Also affected by the same vulnerability, enabling privilege escalation.
- CloudLink 8.1.2 – Vulnerable version that allows exploitation via known privileged credentials.
Mitigation
To mitigate this vulnerability, it is recommended to disable SSH access if not needed and ensure that strong, unique passwords are used for privileged accounts. Regularly updating to the latest version of CloudLink and monitoring access logs can also help in identifying and preventing unauthorized access.