CVE-2025-21117

Vulnerability

Dell Avamar versions 19.4 and later contain an access token reuse vulnerability in the AUI (Avamar User Interface). A low privileged local attacker can exploit this flaw to reuse an access token intended for another user, leading to full impersonation of that user. [1]

Exploitation

An attacker with low-level local access to the Avamar system can leverage the token reuse flaw. The exact sequence involves capturing or reusing a valid access token from the AUI session, then presenting it to impersonate the targeted user. No additional authentication or user interaction is required beyond initial low-privilege access.

Impact

Successful exploitation allows the attacker to fully impersonate the victim user, gaining all privileges and access rights associated with that user within the Avamar environment. This can lead to unauthorized data access, configuration changes, or further lateral movement.

Mitigation

Dell has released a security update to address this vulnerability, detailed in advisory DSA-2025-071 [1]. Users should apply the recommended patch to affected Dell Avamar installations (version 19.4 and later) as soon as possible. No workaround is provided in the advisory.