CVE-2025-46699

Dell Data Protection Advisor, versions prior to 19.12, contains an Improper Neutralization of Special Elements Used in a Template Engine vulnerability in the Server. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000281732/dsa-2025-075-security-update-for-dell-data-protection-advisor-for-multiple-component-vulnerabilities	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dell:data_protection_advisor:*:*:*:*:*:*:*:*

History

17 Jun 2026, 09:26

Type	Values Removed	Values Added
Summary		(es) Dell Data Protection Advisor, versiones anteriores a la 19.12, contiene una vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un motor de plantillas en el servidor. Un atacante en remoto con pocos privilegios podría, potencialmente, explotar esta vulnerabilidad, lo que podría llevar a la exposición de información.

28 Jan 2026, 18:59

Type	Values Removed	Values Added
First Time		Dell Dell data Protection Advisor
CPE		cpe:2.3:a:dell:data_protection_advisor::::::::
References	~~() https://www.dell.com/support/kbdoc/en-us/000281732/dsa-2025-075-security-update-for-dell-data-protection-advisor-for-multiple-component-vulnerabilities -~~	() https://www.dell.com/support/kbdoc/en-us/000281732/dsa-2025-075-security-update-for-dell-data-protection-advisor-for-multiple-component-vulnerabilities - Vendor Advisory

23 Jan 2026, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-23 10:15

Updated : 2026-06-17 09:26

NVD link : CVE-2025-46699

Mitre link : CVE-2025-46699

CVE.ORG link : CVE-2025-46699

JSON object : View

Products Affected

dell

data_protection_advisor

CWE

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

{"id": "CVE-2025-46699", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-46699", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T15:11:41.827726Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security_alert@emc.com", "affectedData": [{"vendor": "Dell", "product": "Data Protection Advisor", "versions": [{"status": "affected", "version": "N/A", "lessThan": "19.12", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-23T10:15:52.847", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000281732/dsa-2025-075-security-update-for-dell-data-protection-advisor-for-multiple-component-vulnerabilities", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-1336"}]}], "descriptions": [{"lang": "en", "value": "Dell Data Protection Advisor, versions prior to 19.12, contains an Improper Neutralization of Special Elements Used in a Template Engine vulnerability in the Server. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure."}, {"lang": "es", "value": "Dell Data Protection Advisor, versiones anteriores a la 19.12, contiene una vulnerabilidad de neutralizaci\u00f3n incorrecta de elementos especiales utilizados en un motor de plantillas en el servidor. Un atacante en remoto con pocos privilegios podr\u00eda, potencialmente, explotar esta vulnerabilidad, lo que podr\u00eda llevar a la exposici\u00f3n de informaci\u00f3n."}], "lastModified": "2026-06-17T09:26:49.697", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:data_protection_advisor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F993597A-30A5-4D7B-83D9-162CC1899B78", "versionEndExcluding": "19.12", "versionStartIncluding": "19.9"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}