Default Credential Vulnerability in DCIM dcTrack Platform by CISA
CVE-2025-66237

8.4HIGH

Key Information:

Vendor

Sunbird

Status
Dcim Dctrack
Iq
Vendor
CVE Published:
4 December 2025

What is CVE-2025-66237?

The DCIM dcTrack platform has a vulnerability stemming from the use of default and hard-coded credentials. An attacker could exploit this issue to gain administrative access to the database, execute unauthorized commands on the host system, and escalate their privileges. This can lead to severe security risks, compromising the integrity and confidentiality of sensitive data managed within the platform. Organizations using dcTrack should immediately review their security practices and update their access credentials to mitigate potential threats.

Affected Version(s)

DCIM dcTrack 0

IQ 0

DCIM dcTrack 9.2.3

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-3...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

notnotnotveg ([email protected]) reported these vulnerabilities to CISA.
JSON
.
CVE-2025-66237 : Default Credential Vulnerability in DCIM dcTrack Platform by CISA