CVE-2025-45378 is a critical flaw (CVSS 9.1) in Dell CloudLink versions 8.0 through 8.1.2. A privileged user with a known password can break out of the restricted shell, reach a full command shell and escalate privileges. Apply the fix described in Dell advisory DSA-2025-374 and review SSH access.
What's affected
Per the CVE record, Dell CloudLink versions 8.0 through 8.1.2 are affected. The record describes a vulnerability in the restricted shell: a privileged user with a known password can break into the command shell of the CloudLink server, gain shell access and escalate privilege.
It adds that if SSH is enabled with the web credentials of the server, the attack is possible over the network with a known privileged user and password.
The record references one document, Dell Security Advisory DSA-2025-374, titled as a security update for Dell CloudLink with multiple vulnerabilities. Dell's site refused my request to fetch it, so I cannot confirm the fixed version. Read the advisory directly for the release that contains the fix.
The vector requires high privileges, which is why the score sits at 9.1 and not higher. The scope is changed, and impact is high on all three measures. The KEV flag is false, and the record does not report attacks in the wild.
How to check if you're exposed
Check the CloudLink version in the management interface. Versions from 8.0 through 8.1.2 are in range according to the record.
Then check whether SSH is enabled on the server, since the record singles out that path:
nmap -p 22 <cloudlink-address>
Run this only against systems you own. Look in the CloudLink settings for the SSH option, and see who holds privileged accounts. The key condition in the record is a known privileged user and password, so the number and strength of those credentials matters.
Review logs for SSH sessions from unexpected addresses, and for privileged logins at odd hours.
What to do now
- Find every CloudLink server and note its version.
- Read DSA-2025-374 and install the update it names for your release.
- If SSH is not needed, turn it off. If it is, restrict it to a management network and named admin hosts.
- Reset passwords for privileged CloudLink accounts, and use long unique values.
- Remove privileged accounts that are no longer used.
- Review logs from before the update for unexpected shell sessions.
- Record the update in your change log, and add the product to your advisory watch list.
Why it matters
The record maps the issue to CWE-78, OS command injection. A restricted shell is meant to give an administrator a limited menu of actions. If input can slip past those limits, the restricted shell turns into a full one, with the rights of the service behind it.
CloudLink is a key management product, so the host holds sensitive material. A shell on that server is a serious position for anyone who gets it, even though an attacker first needs a privileged account.
That prerequisite is the main reason the risk is manageable. Tight control of who holds privileged credentials, and where they can sign in from, goes a long way here. It is also a reminder to treat appliance consoles with the same care as any other admin interface.
For the libraries in your own software, Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan is a quick start, and the Gold directory covers related CVEs.
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2025-45378 being exploited in the wild?
The record does not report exploitation and its CISA KEV flag is false. That can change, so check the CISA catalog again before you decide how urgent this is.
Do I need a privileged account to abuse this?
Yes. The record describes a privileged user with a known password, and the CVSS vector requires high privileges. Protecting those credentials lowers the risk, but you still need to update.
Sources
- CVE-2025-45378 on Gold
- NVD record for CVE-2025-45378
- Dell Security Advisory DSA-2025-374, listed in the CVE record. Dell's site denied my fetch, so read it directly.
Last reviewed: 18 October 2026.
