Dell Unity
CVE-2025-43942
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local account
-
DeliverySupply crafted input with shell metacharacters
-
ExploitTrigger OS command injection (CWE-78)
-
ExecutionExecute commands as privileged user
-
ImpactFull compromise of Unity storage system
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess a low-privileged account with local access to a Dell Unity / Unity XT / UnityVSA system running Operating Environment version 5.5 or earlier (AV:L/PR:L), and no user interaction is needed (UI:N). The vulnerable path is an OS command injection (CWE-78) where attacker-supplied special characters reach an operating-system command; the specific feature/input is not detailed in the provided data. The chief limiting factors are the need for prior local authentication and the absence of any remote/network vector - a remote unauthenticated attacker cannot trigger this directly, which substantially narrows real-world exposure to post-foothold privilege escalation. |
| Impact | This is a genuine but moderate-priority issue rather than an emergency. The CVSS 3.1 score of 7.8 (High) is driven entirely by the impact metrics (C:H/I:H/A:H) rather than ease of access: the vector is AV:L (local access required), AC:L, PR:L (attacker must already hold a low-privileged local account), and UI:N, with S:U (no scope change). The real-world exploitation signals are quiet and consistent with this: EPSS is only 0.57% (46th percentile), the CVE is NOT on the CISA KEV list, and no public exploit code has been identified. Exploitation status is therefore 'no public exploit identified at time of analysis.' No SSVC decision record was provided in the input. The signals do not conflict - a low EPSS, absence from KEV, and a local-only privilege-escalation vector all align, indicating this is a defense-in-depth patch priority (it converts a low-privileged foothold into full compromise) rather than a widely-weaponized internet-facing threat. Key caveat: the only reference is the Dell vendor advisory (DSA-2025-379); affected-version detail beyond '5.5 and prior' and any fixed version were not supplied in the input and should be confirmed against that advisory. |
| Exploit ScenarioDerived | An attacker who has already obtained a low-privileged local account on a Dell Unity storage system (for example via a weak service credential or an earlier foothold) injects crafted shell metacharacters into an input that is passed unsanitized to an OS command. The injected command runs with elevated privileges, giving the attacker full control of the storage controller. No public proof-of-concept is known, and exploitation requires pre-existing local access (AV:L/PR:L), which limits opportunistic use. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
OS command injection in Dell Unity, Unity XT, and UnityVSA running Unity Operating Environment 5.5 and earlier allows a low-privileged local attacker to execute arbitrary operating-system commands, escalating privileges to full control of the storage appliance. Exploitation requires an existing local account on the system (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and no user interaction; there is no remote or network vector, so the realistic threat model is post-foothold privilege escalation rather than direct remote compromise. EPSS is low at 0.57% (46th percentile) and no public exploit identified at time of analysis; Dell has published advisory DSA-2025-379 covering the fix.
RemediationAI
Apply the Dell security update described in advisory DSA-2025-379 (https://www.dell.com/support/kbdoc/en-us/000385307/dsa-2025-379-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities) to bring the Unity Operating Environment above version 5.5; patch availability is confirmed per the vendor advisory, and the exact fixed OE build should be taken from that document. Because the flaw requires a pre-existing low-privileged local account, the most effective compensating controls are identity-based: audit and remove unnecessary local OS accounts, restrict local console and SSH/CLI access to a small set of trusted administrators, and enforce least privilege so that routine operators do not hold interactive appliance access (trade-off: this can slow legitimate administrative workflows and should be paired with a documented break-glass account). Restrict and monitor the Unisphere management interface through network segmentation and administrative VLANs, since management access is a common route to obtaining the local account needed here (trade-off: segmentation complicates remote support tooling). Enable audit logging and alerting on unexpected child processes or shell invocations spawned by Unity services to catch post-exploitation activity, and note that perimeter or remote-exploitation mitigations have limited value against this local-only vector.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dell Unity is an enterprise unified (block and file) storage platform whose software stack is the Unity Operating Environment (OE); UnityVSA is the virtualized appliance and Unity XT the hardware line, and all three share the same OE code base tracked by the CPE cpe:2.3:a:dell:unity_operating_environment:*:*:*:*:*:*:*:*. The defect is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning input controlled by a user is passed to a shell or command interpreter without proper escaping, so shell metacharacters can chain or substitute commands. The CVSS vector AV:L/PR:L/UI:N with High impacts across confidentiality, integrity, and availability indicates that a user holding only an ordinary low-privileged local account can reach the vulnerable command path and, because the injected command executes in the context of the affected service, obtain elevated privileges. The specific feature or parameter that fails to sanitize input is not detailed in the available data; the underlying risk class is command injection into a privileged operating-system call on a storage appliance that typically holds sensitive data and management credentials.
Know when Unity Operating Environment gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description confirms local access by a low-privileged attacker (AV:L/PR:L) with no user interaction; OS command execution as a privileged user yields full C:H/I:H/A:H.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
DescriptionCVE.org
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privileges.
Executive ViewAI
Dell Unity, Unity XT, and UnityVSA storage appliances running Unity Operating Environment 5.5 and earlier contain an OS command injection flaw that lets an attacker who already holds a low-privileged local account take full control of the appliance. Because these systems typically sit at the center of enterprise storage and backup infrastructure, a successful escalation could expose, alter, or destroy business-critical data and disrupt dependent applications across the organization. Leadership should treat this as a contained but serious post-foothold risk that depends on an attacker first gaining a local account on the appliance.
No vendor-released patch identified at time of analysis; Dell advisory DSA-2025-379 addresses the fix and should be reviewed for remediation guidance. Interim mitigations: restrict local account access on Unity appliances to essential administrators, remove or disable unused accounts, enforce strong unique credentials and rotation, segment storage management interfaces from user and general-purpose networks, enable and monitor CLI/audit logging for anomalous privileged command execution, and apply least-privilege controls on any system with a local account on the appliance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)CVE.org
More in Unity Operating Environment
View allDell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication atte
Dell Unity, version(s) 5.4 and prior, contain(s) an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. R
Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
OS command injection in Dell Unity Operating Environment 5.5 and earlier lets an authenticated local user with low privi
OS command injection in Dell Unity Operating Environment 5.5 and prior allows an authenticated local low-privileged atta
OS command injection in the Dell Unity Operating Environment (version 5.4 and prior) allows a locally authenticated, low
OS command injection in Dell Unity, UnityVSA, and Unity XT operating environment version 5.5 and prior allows a low-priv
Command injection in Dell Unity Operating Environment (OE) 5.5 and prior lets an authenticated low-privileged attacker w
Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
GitHub PoC
Exploit-DB