Sunbird DCIM dcTrack platforms contain hard-coded and default credentials that can be used by an attacker with local access to gain administrative control over the database, escalate privileges on the platform, or execute system commands on the host system. This vulnerability is tracked as CVE-2025-66237 and is classified under CWE-798 (Use of Hard-coded Credentials). The CVSS 4.0 base score is 8.4, reflecting high severity with local attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. The vulnerability affects version 0 of the product, and no cloud service is involved. No patch or vendor advisory is currently available.

Exploitation of this vulnerability allows an attacker with local access to leverage hard-coded credentials to fully administer the database, escalate privileges on the platform, and execute arbitrary system commands on the host. This can lead to complete compromise of the affected system's confidentiality, integrity, and availability. The high CVSS score reflects the critical nature of these impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for unauthorized access attempts. Avoid deploying affected versions in untrusted environments.