Dell Unity
CVE-2025-43941
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local account on unlicensed array
-
ExploitInject special characters into vulnerable OS command input
-
ExecutionCommand executes with root privileges
-
ImpactFull compromise of storage appliance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Three conditions must hold simultaneously: (1) the attacker already possesses a low-privileged LOCAL account on the appliance (PR:L, AV:L - no network path); (2) the target Dell Unity system is running WITHOUT a valid license installed, per the advisory the vulnerability 'only affects systems without a valid license install,' so licensed production arrays are not exploitable; and (3) affected firmware is Dell Unity Operating Environment version 5.5 or prior. No user interaction is required (UI:N). The unlicensed-state requirement is the dominant limiting factor and sharply narrows the realistic target population to evaluation, trial, or improperly-licensed deployments. |
| Impact | Signals are moderate and largely consistent. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) scores 7.8 (HIGH) but is explicitly LOCAL and requires PR:L (an existing low-privileged local account), so this is not a remotely reachable flaw. EPSS is low at 0.69% (51st percentile), the CVE is NOT in CISA KEV, and no public exploit was identified - three independent signals all pointing to low real-world exploitation pressure, which is coherent rather than conflicting. Crucially, the description adds a strong limiting precondition that CVSS does not capture: the vulnerability 'only affects systems without a valid license install,' meaning licensed production deployments are not affected at all. Net: this is a genuine privilege-escalation-to-root issue worth patching on unlicensed/evaluation units, but it is a lower operational priority than its 7.8 HIGH rating alone implies, because it needs local access, a foothold account, and an unlicensed system state simultaneously. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged local account on an unlicensed Dell Unity system supplies specially crafted input to a feature that passes it unsanitized to an OS command, causing the injected command to run with root privileges. No public exploit code was identified at time of analysis, and remote exploitation is not possible given the local (AV:L) attack vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
OS command injection in Dell Unity Operating Environment 5.5 and earlier lets an authenticated local user with low privileges execute arbitrary commands as root, but only on arrays running without a valid license. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) confirms the attacker must already hold a foothold on the appliance; there is no network-reachable path and no user interaction is required. Exploitation is sharply limited by the missing-license precondition, EPSS is low at 0.69% (51st percentile), and no public exploit code has been identified at time of analysis.
RemediationAI
Apply the fixed Dell Unity Operating Environment release published under Dell advisory DSA-2025-379 (https://www.dell.com/support/kbdoc/en-us/000385307/dsa-2025-379-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities); patch availability is confirmed per vendor advisory but no exact fixed build number was provided in the source data, so consult the advisory for the precise version and upgrade path for Unity, UnityVSA, and Unity XT. Because the defect only triggers on systems without a valid license, the most immediate compensating control is to install and activate a valid license on any unlicensed Unity OE 5.5-or-earlier deployment, which removes the vulnerable code path entirely; for equipment that must remain unlicensed, restrict local shell and CLI access to trusted administrators only and audit low-privileged local accounts, since PR:L is the attacker's prerequisite and there is no network vector to block. Neither workaround is a substitute for the vendor patch, and the licensing workaround's main trade-off is that licensing may be operationally or commercially constrained in lab and evaluation environments.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-78, Improper Neutralization of Special Elements used in an OS Command, meaning input reaching a shell invocation is not sanitized before the operating system parses it. In the Dell Unity Operating Environment this class of bug typically arises where CLI helpers, licensing utilities, or management scripts construct shell commands from locally supplied arguments and then execute them; because those processes run with elevated privileges, a successful injection escalates from a low-privileged local account to root. The CPE entry cpe:2.3:a:dell:unity_operating_environment:*:*:*:*:*:*:*:* covers the affected operating environment; the CVE description limits scope to Unity OE 5.5 and prior and explicitly notes the defect only manifests on systems without a valid license installed, which the independent assessment treats as the dominant limiting precondition alongside the requirement for an existing local account and affected firmware.
Know when Unity Operating Environment gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local foothold and existing low-priv account give AV:L/PR:L; injection to root yields full C:H/I:H/A:H; the unlicensed-state precondition limits applicability but is not attacker-controlled, so AC:L retained.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Dell Unity, version(s) 5.5 and Prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary command with root privileges. This vulnerability only affects systems without a valid license install.
Executive ViewAI
Organizations running Dell Unity Operating Environment 5.5 or earlier on storage arrays without a valid license face a high-severity local privilege escalation risk. An attacker who already has low-privileged local access could execute arbitrary commands as root, potentially compromising the entire array and any data it stores. However, this vulnerability cannot be exploited remotely or without a local foothold, and the missing-license precondition further narrows the exposure.
Ensure all Dell Unity arrays have a valid license, as the vulnerability only affects arrays without a valid license. Additionally, restrict local shell access to trusted administrators, enforce least privilege for local accounts, and monitor for anomalous command execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)NVD
More in Unity Operating Environment
View allDell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication atte
Dell Unity, version(s) 5.4 and prior, contain(s) an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. R
Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
OS command injection in Dell Unity, Unity XT, and UnityVSA running Unity Operating Environment 5.5 and earlier allows a
OS command injection in Dell Unity Operating Environment 5.5 and prior allows an authenticated local low-privileged atta
OS command injection in the Dell Unity Operating Environment (version 5.4 and prior) allows a locally authenticated, low
OS command injection in Dell Unity, UnityVSA, and Unity XT operating environment version 5.5 and prior allows a low-priv
Command injection in Dell Unity Operating Environment (OE) 5.5 and prior lets an authenticated low-privileged attacker w
Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
GitHub PoC
Exploit-DB