Dell Display Manager up to 2.3.2.19 toctou

Summaryinfo

A vulnerability was found in Dell Display Manager up to 2.3.2.19 and classified as critical. This affects an unknown part. The manipulation results in toctou. This vulnerability is identified as CVE-2025-22394. The attack is only possible with local access. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Dell Display Manager up to 2.3.2.19. It has been classified as critical. Affected is an unknown code. The manipulation with an unknown input leads to a toctou vulnerability. CWE is classifying the issue as CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Dell Display Manager, versions prior to 2.3.2.18, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to code execution and possibly privilege escalation.

The advisory is shared for download at dell.com. This vulnerability is traded as CVE-2025-22394 since 01/06/2025. The exploitability is told to be difficult. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 214307 (Dell Display Manager Multiple Vulnerabilities (DSA-2025-033)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.3.2.20 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (214307). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Dell

Name

• Display Manager

Version

• 2.3.2.0
• 2.3.2.1
• 2.3.2.2
• 2.3.2.3
• 2.3.2.4
• 2.3.2.5
• 2.3.2.6
• 2.3.2.7
• 2.3.2.8
• 2.3.2.9
• 2.3.2.10
• 2.3.2.11
• 2.3.2.12
• 2.3.2.13
• 2.3.2.14
• 2.3.2.15
• 2.3.2.16
• 2.3.2.17
• 2.3.2.18
• 2.3.2.19

License

• commercial

Website

• Vendor: https://www.dell.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion