What’s Vulnerable › Vulnerabilities

CVE-2025-66238: Sunbird DCIM dcTrack and Power IQ Authentication Bypass Using an Alternate Path or Channel

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-04 · updated 2026-06-17
• Weakness: CWE-288

Description

DCIM dcTrack allows an attacker to misuse certain remote access features. An authenticated user with access to the appliance's virtual console could exploit these features to redirect network traffic, potentially accessing restricted services or data on the host machine.

Affected products

• Sunbird DCIM dcTrack: through v9.2.0
• Sunbird IQ: through v9.2.0

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-338-05.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-338-05

Get alerted when CVE-2025-66238 or the next vulnerability affects your stack