CVE-2025-21106 Misconfiguration in RecoverPoint for VMs
A local low-privileged attacker can exploit weak file system permissions to impact non-sensitive resources in Dell RecoverPoint for Virtual Machines.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-21106?
CVE-2025-21106 is a medium-severity vulnerability in Dell RecoverPoint for VMs, published on 20 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Dell Recover Point for Virtual Machines 6.0.X contains a Weak file system permission vulnerability. A low privileged Local attacker could potentially exploit this vulnerability, leading to impacting only non-sensitive resources in the system.
Weakness: CWE-276
Which versions are affected by CVE-2025-21106?
It affects 1 product.
Products include Dell Recoverpoint for Virtual Machines.
How do I fix CVE-2025-21106?
No fix has been published for CVE-2025-21106 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-21106 being exploited?
There is no known exploitation of CVE-2025-21106 in the wild and no public exploit code.
Other vulnerabilities in Dell RecoverPoint for VMs
- CVE-2026-22769 Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials
- CVE-2024-22461 Command injection in RecoverPoint for Virtual Machines
- CVE-2016-6650 Security feature bypass in EMC RecoverPoint versions prior to 5.0 and EMC RecoverPoint for Virtual Machines versions prior to 5.0
- CVE-2024-22426 Command injection in RecoverPoint for VMs
- CVE-2016-6649 Command injection in EMC RecoverPoint and EMC RecoverPoint for Virtual Machines EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoint for Virtual Machines versions before 5.0
Sources
Also known as GHSA-78pr-2fh5-229x.