Dell Unity CVE-2025-43939

Requires LOCAL access to a Dell Unity, UnityVSA, or Unity XT system (CVSS AV:L) plus an existing LOW-privileged authenticated account (PR:L) - the attacker must already be able to run on or authenticate to the appliance before exploiting the OS command injection. No user interaction by a victim is needed (UI:N) and attack complexity is low (AC:L). The description does not name a specific feature or non-default configuration that must be enabled, so the flaw appears reachable through normal low-privileged use of affected versions (5.4 and prior); the primary limiting factors are the local-access and prior-authentication prerequisites, which exclude remote unauthenticated attackers and sharply reduce internet-wide exploitability.

This is a genuine but operationally-bounded risk rather than a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) is internally consistent with the description: exploitation requires LOCAL access and LOW (PR:L) existing privileges, so this is a privilege-escalation primitive for an attacker who already has a foothold on the array, not a remote-unauthenticated breach vector. EPSS is low at 0.57% (46th percentile), which aligns with the local attack vector - mass, internet-wide automated exploitation is not expected for a flaw that demands prior local/authenticated access. The CVE is NOT on CISA KEV and no public exploit code was provided in the input, so there is no public exploit identified at time of analysis and no confirmed active exploitation. No SSVC decision data was supplied, so exploitation-status/automatable/technical-impact cannot be independently evaluated. Signals are mutually consistent (low EPSS + local vector + no KEV = not a widespread-exploitation priority), but technical impact is high: successful exploitation yields full command execution and elevation to higher privileges on a storage controller, so for environments where untrusted or low-privileged local accounts exist on Dell Unity, this should be patched promptly as a post-compromise escalation risk.

An attacker who already holds a low-privileged local account or shell on a Dell Unity / UnityVSA / Unity XT controller (for example via a compromised service account or an earlier foothold) injects crafted shell metacharacters into an input consumed by a privileged OS command. The injected command executes with elevated privileges, giving the attacker full control of the storage controller. No public proof-of-concept was provided, and the local, authenticated prerequisite limits this to post-foothold escalation rather than initial remote access.