CVE-2025-66238 Sunbird DCIM dcTrack and Power IQ Authentication Bypass Using an Alternate Path or Channel
An authenticated user can bypass authentication restrictions to access restricted services or data on the host machine via virtual console features.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-66238?
CVE-2025-66238 is a high-severity authentication bypass vulnerability in Sunbird DCIM dcTrack, published on 4 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
DCIM dcTrack allows an attacker to misuse certain remote access features. An authenticated user with access to the appliance's virtual console could exploit these features to redirect network traffic, potentially accessing restricted services or data on the host machine.
Weakness: CWE-288
Which versions are affected by CVE-2025-66238?
How do I fix CVE-2025-66238?
No fix has been published for CVE-2025-66238 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-66238 being exploited?
There is no known exploitation of CVE-2025-66238 in the wild and no public exploit code.
Sources
Also known as GHSA-q579-mcrq-q4vr.