CVE-2025-26336 is a high severity (CVSS 8.3) stack based buffer overflow in Dell Chassis Management Controller firmware for PowerEdge FX2 and VRTX. An unauthenticated attacker with remote access could potentially achieve remote execution. Update the CMC firmware to the fixed versions in Dell security advisory DSA-2025-123.
What's affected
- Product: Dell Chassis Management Controller (CMC) firmware for Dell PowerEdge FX2 and for Dell PowerEdge VRTX.
- Affected: FX2 firmware prior to 2.40.200.202101130302, and VRTX firmware prior to 3.41.200.202209300499, per the NVD record.
- Fixed: Dell's advisory DSA-2025-123 carries the fixed versions. Use that page to pick the right release for your hardware, since we could not retrieve it when we checked.
- Vector: network reachable, no privileges, but user interaction is required.
How to check if you're exposed
Check the firmware version in the CMC web interface, in the system or firmware inventory area, or through your normal Dell management tooling. If you use remote management commands, query the firmware inventory for the chassis and compare it with the two thresholds above.
Then map where the CMC network ports sit. A chassis management controller should live on a dedicated out of band management network. Verify that no CMC address is reachable from user networks or the internet, and that no firewall rule or port forward exposes it.
nmap -Pn -p 443 <cmc-address-range>
Run that only against your own management range, from a place that should not have access. Any response from an unexpected network is a finding to fix.
What to do now
- Open Dell security advisory DSA-2025-123 and note the fixed firmware version for each chassis model.
- Schedule the CMC firmware update during a maintenance window and follow Dell's update instructions, including backups of configuration.
- Confirm every CMC sits on an isolated management network and that no route reaches it from user or internet networks.
- Restrict management access to a small set of administration hosts, and use a jump host or VPN.
- After updating, recheck the firmware version in the interface and in your inventory.
- Record end of support dates for older chassis models, since they may stop receiving firmware.
Why it matters
The weakness is a stack based buffer overflow. Firmware code copies data into a fixed size buffer on the call stack without checking that the input fits. Memory next to the buffer, including data that controls where the program goes next, can then be overwritten.
- CWE-121 is a stack based buffer overflow, the variant where the overflowing buffer lives on the call stack next to saved control data.
- CWE-787 is an out of bounds write. Memory outside the intended buffer gets overwritten, which on embedded devices can corrupt control data and change what the program does next.
Management controllers have deep reach. They manage power, console access and firmware for the hardware they watch, and they often run for years with no updates because nobody owns them. The NVD vector asks for user interaction, which narrows the set of realistic paths, but Dell describes the possible outcome as remote execution. Good segmentation of the management network does more for you than any single patch, and it protects against the next advisory too.
Quick check
Which firmware fixes it?
Dell's advisory DSA-2025-123 lists the fixed firmware. The record names FX2 prior to 2.40.200.202101130302 and VRTX prior to 3.41.200.202209300499 as affected.
Does this need a login?
The vector shows no privileges required, but it does require user interaction. Keep management interfaces off untrusted networks either way.
Sources
Last reviewed: 19 October 2026.
