Dell Unity CVE-2025-46422

Exploitation requires local access to a Dell Unity / Unity XT / UnityVSA system running version 5.5 or prior, plus an authenticated low-privileged account (PR:L) on the appliance - the attacker must already be able to reach a management interface or CLI that accepts attacker-controlled input. No user interaction by a victim is needed (UI:N). The limiting factors are the local attack vector (no remote network exploitation per AV:L) and the need for valid low-privilege credentials or an existing foothold; successful injection yields root-level command execution. The specific vulnerable feature/parameter is not enumerated in the available description.

This is a genuinely serious but access-gated vulnerability rather than an opportunistic internet-wide threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) requires local access and low privileges, but delivers full High confidentiality, integrity, and availability impact because the injected OS command executes as root - a complete privilege escalation on the storage controller. The EPSS score is low (0.50%, 41st percentile), which is consistent with the local attack vector: exploitation cannot be mass-scanned or remotely weaponized, so broad automated exploitation is unlikely. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed as actively exploited. The signals are internally consistent - low EPSS and local vector both point to a targeted, post-access escalation primitive rather than a widespread remote threat. No conflicting data was observed; the primary limiting factor is the AV:L requirement, meaning an attacker must already have authenticated low-privilege access to the appliance (e.g., a restricted management account) before this becomes exploitable.

An attacker who has already obtained low-privileged authenticated access to a Dell Unity storage system (for example, a limited operator account or a compromised service credential) supplies specially crafted input to a management function that passes unsanitized data to an OS command. The injected special elements break out of the intended command context and run arbitrary commands with root privileges, giving full control of the storage controller. No public exploit code has been identified at time of analysis.