Executive Summary

Dell has released an urgent security advisory (DSA-2025-375) for a critical vulnerability in its Data Lakehouse platform, tracked as CVE-2025-46608. The flaw, rated 9.1 out of 10 on the CVSS v3.1 scale, is an improper access control vulnerability. It could allow a remote attacker who already possesses high-level privileges to escalate them further, leading to a full compromise of the affected system. The vulnerability's impact is considered critical because it can cross security boundaries, affecting resources beyond the vulnerable component itself. Dell strongly recommends customers update to the patched version, Data Lakehouse 1.6.0.0, as a matter of priority.

Vulnerability Details

• CVE ID: CVE-2025-46608
• CVSS Score: 9.1 (Critical)
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
• Description: The vulnerability is an improper access control weakness. The vector breakdown indicates that an attacker must already be highly privileged (PR:H) to exploit it. However, the exploit is low complexity (AC:L), requires no user interaction (UI:N), and can be performed over the network (AV:N). Most importantly, the scope is changed (S:C), meaning a successful exploit can impact resources beyond the security scope of the vulnerable component, leading to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H).

Affected Systems

• Product: Dell Data Lakehouse
• Affected Versions: All versions prior to 1.6.0.0

Exploitation Status

There is currently no evidence that CVE-2025-46608 is being exploited in the wild. However, given its critical rating and the detailed information available, security researchers and threat actors may attempt to develop proof-of-concept (PoC) exploits. Organizations should operate under the assumption that exploitation is possible and imminent.

Impact Assessment

While the prerequisite of high initial privileges might limit the number of potential attackers, the impact of a successful exploit is maximum. An attacker could gain complete control over the Data Lakehouse environment. This platform often stores vast quantities of sensitive business and customer data for analytics purposes. A compromise could lead to a catastrophic data breach, manipulation of critical business intelligence, and complete service disruption. The ability for the exploit to affect adjacent systems (S:C) means a compromised Data Lakehouse could serve as a powerful pivot point for a wider network intrusion.

Cyber Observables for Detection

• Log Source: Dell Data Lakehouse audit logs, network flow logs.
• Indicator: Monitor for any authentication or API calls from unexpected internal IP ranges, especially those associated with high-privilege service accounts.
• Indicator: Look for the creation of new user accounts with elevated permissions or the modification of permissions for existing high-privilege accounts. This could be a sign of an attacker establishing persistence after exploitation.

Detection Methods

• Vulnerability Scanning: Use authenticated vulnerability scanners to check the version of Dell Data Lakehouse deployments across the environment and identify all instances that are not running version 1.6.0.0 or later. Use D3FEND's Vulnerability Scanning.
• Log Analysis: Ingest Data Lakehouse application and access logs into a SIEM. Create rules to alert on unusual administrative activities, such as access from non-standard IP addresses or activity outside of normal business hours. Use D3FEND's Local Account Monitoring.
• Configuration Auditing: Regularly audit the configurations and permissions within the Data Lakehouse platform to detect unauthorized changes.

Remediation Steps

1. Apply the Update: The primary and most effective remediation is to upgrade all Dell Data Lakehouse instances to version 1.6.0.0 or later. This update contains the fix for CVE-2025-46608.
2. Principle of Least Privilege: Review all accounts with access to the Data Lakehouse platform. Ensure that only a minimum number of trusted administrators have high-privilege access. This reduces the pool of accounts that could be used to launch the attack.
3. Network Isolation: As a compensating control, restrict network access to the Data Lakehouse management interfaces. Access should be limited to a small set of administrative workstations or a secure management network. This aligns with D3FEND's Network Isolation.
4. Monitor Privileged Accounts: Implement enhanced monitoring for all accounts that meet the 'High' privilege prerequisite. Any activity from these accounts should be closely scrutinized.