CVE-2025-23374 Information disclosure in Enterprise SONiC OS
A high-privileged remote attacker can exploit sensitive information logged in Dell Networking Switches to expose confidential data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-23374?
CVE-2025-23374 is a high-severity vulnerability in Dell Enterprise SONiC OS, published on 30 Jan 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Dell Networking Switches running Enterprise SONiC OS, version(s) prior to 4.4.1 and 4.2.3, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
Weakness: CWE-532
Which versions are affected by CVE-2025-23374?
It affects 1 product.
Products include Dell Enterprise Sonic Distribution.
How do I fix CVE-2025-23374?
No fix has been published for CVE-2025-23374 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-23374 being exploited?
There is no known exploitation of CVE-2025-23374 in the wild and no public exploit code.
Other vulnerabilities in Dell Enterprise SONiC OS
Sources
Also known as GHSA-xwc6-4mcf-7v2v.