Dell Unity CVE-2025-43940

Exploitation requires LOCAL access to a Dell Unity, UnityVSA, or Unity XT system running Unity Operating Environment 5.5 or prior, plus authenticated LOW-privilege credentials on that system (CVSS PR:L) - it cannot be triggered remotely over the network (AV:L) and needs no user interaction (UI:N). The description does not name a specific feature flag or non-default configuration, implying a vulnerable OS command path reachable by any low-privileged local user; the precise injectable input/command is not specified in the available data. The key limiting factors are the local-access requirement and the need for a pre-existing low-privilege account, which significantly narrow the realistic attacker population to insiders or post-foothold intruders.

This is a credible but non-urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires LOCAL access and existing LOW privileges on the Dell Unity appliance - it is not a remote, pre-auth bug - while the C:H/I:H/A:H impact (reflecting the stated command execution and privilege elevation) is what drives the 7.8 HIGH base score. The signals are internally consistent and point to a local privilege-escalation issue rather than a mass-exploitable remote flaw. EPSS is low at 0.57% (46th percentile), the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced, so there is no evidence of active or imminent widespread exploitation. The dominant real-world risk is an authenticated low-privilege user (or an attacker who has already gained a foothold/limited shell) escalating to full control of the storage array; raw CVSS overstates urgency relative to the local-access precondition, so this should be patched on a normal maintenance cadence, prioritized where untrusted or semi-trusted users have any local/CLI access to Unity systems.

An attacker who already holds a low-privilege local account or limited shell on a Dell Unity / UnityVSA / Unity XT system injects crafted shell metacharacters into an input passed to an OS command, causing the appliance to execute attacker-controlled commands at a higher privilege level. This yields command execution and elevation of privileges over the storage platform. No public exploit code is identified at time of analysis, and the local-access, low-complexity nature means a motivated insider or a chained post-foothold attacker is the realistic threat.