Database/Control plane, storage & DevOps

Dell CloudLink (command injection): Command injection giving a privileged user full control of the CloudLink system

CVSS 8.4CVE-2025-30479Control plane, storage & DevOpscurated

Impact

Command injection giving a privileged user full control of the CloudLink system.

Who can reach it

Adjacent network with a known privileged password.

What to do

Upgrade CloudLink to 8.2.

References

https://www.dell.com/support/kbdoc/en-us/000384363/dsa-2025-374-security-update-for-dell-cloudlink-multiple-security-vulnerabilities

Related entries

Dell CloudLink (console command injection): Command injection from the console giving shell accessCVE-2025-45379 · Dell CloudLink (console command injection)High
Renovate (kustomize manager): chart names are injected into helm pull commands, running attacker shell commandsCVE-2026-76229 · Renovate (kustomize manager, helm pull)High
Renovate (helmv3 manager): repository value from Chart.yaml is injected into helm registry login commandsCVE-2026-76232 · Renovate (helmv3 manager, helm registry login)High
Vertiv Avocent UMG-4000 universal management gateway: Every command the UMG-4000's web interface runs executes as rootCVE-2019-9507 · Vertiv Avocent UMG-4000 universal management gatewayHigh
Eaton Intelligent Power Manager (IPM) prior to 1.69 - dynamic eval: Unauthenticated eval injection: user-controlledCVE-2021-23277 · Eaton Intelligent Power Manager (IPM) prior to 1.69 - dynamic evalHigh
Intel C++ Compiler Classic / oneAPI toolkits (Unicode source handling): Improper handling of Unicode bidirectionalCVE-2022-25987 · Intel C++ Compiler Classic / oneAPI toolkits (Unicode source handling)High

All Control plane, storage & DevOps entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.