Sunbird DCIM dcTrack and Power IQ Authentication Bypass Using an Alternate Path or Channel

published 2025-12-04 11 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-201312

cvss: 7.2; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 30%
public exploits: 0; none known

DCIM dcTrack allows an attacker to misuse certain remote access features. An authenticated user with access to the appliance's virtual console could exploit these features to redirect network traffic, potentially accessing restricted services or data on the host machine.

Patch / fix

fixed in 2

Sunbird DCIM dcTrack 9.2.3
Sunbird IQ 9.2.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-338-05 updated 2025-12-04 cvss 6.5

Sunbird DCIM dcTrack and Power IQ

Sunbird DCIM dcTrack <=v9.2.0 Sunbird Power IQ <=v9.2.0
affected: mitigation “Sunbird recommends that users take the following actions:”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 11 mo ago (2025-12-05)

Exploit prediction

0.37% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	7.4	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA	4.0	7.4	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Sunbird DCIM dcTrack
Sunbird IQ

Classification

Weakness

CWE-288 Authentication Bypass Using an Alternate Path or Channel

References

Sources

CVE List CVE-2025-66238
NVD CVE-2025-66238

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary