PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-66238 Sunbird CVE debrief

CVE-2025-66238 affects Sunbird DCIM dcTrack and Power IQ. According to CISA’s advisory, an authenticated user with access to the appliance’s virtual console could misuse remote access features to redirect network traffic, which may expose restricted services or data on the host machine. CISA published the advisory on 2025-12-04 and lists vendor guidance to update affected products or apply access restrictions if immediate updating is not possible.

Vendor
Sunbird
Product
DCIM dcTrack
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-12-04
Original CVE updated
2025-12-04
Advisory published
2025-12-04
Advisory updated
2025-12-04

Who should care

Administrators and operators of Sunbird DCIM dcTrack and Power IQ, especially environments that expose virtual console, SSH, or other non-essential management access to the appliance.

Technical summary

The issue is described as misuse of certain remote access features by an authenticated user who already has access to the appliance’s virtual console. The practical impact is traffic redirection from the appliance in a way that could allow access to restricted services or data on the host machine. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, which aligns with a medium-severity impact requiring high privileges.

Defensive priority

Medium. Prioritize remediation where management interfaces or virtual console access are reachable by more users than necessary, or where the appliance sits in sensitive network segments.

Recommended defensive actions

  • Update dcTrack to 9.2.3.
  • Update Power IQ to 9.2.1.
  • If immediate updating is not possible, restrict SSH or other non-essential port access in IP-based access control.
  • Change passwords for SSH-based user accounts at deployment time.
  • Review which administrators and support users can access the appliance virtual console and remove unnecessary access.

Evidence notes

Source evidence comes from CISA’s CSAF advisory ICSA-25-338-05, published 2025-12-04, which identifies Sunbird as the vendor and lists dcTrack and Power IQ as affected products. The advisory describes authenticated misuse of virtual console remote access features leading to possible redirection of network traffic and exposure of restricted services or data. The supplied data also includes Sunbird remediation guidance and a CVSS v3.1 score of 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). No KEV entry is provided in the supplied corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-66238 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-66238

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-66238 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-66238

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-338-05.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-338-05

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.