Dell Unity
CVE-2025-46423
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local account on Unity
-
DeliveryCraft input with shell metacharacters to management command
-
ExploitTrigger OS command injection
-
ExecutionExecute arbitrary commands as root
-
ImpactFull control of storage appliance and data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires pre-existing local access to a Dell Unity / UnityVSA / Unity XT system (versions 5.5 and prior) with a low-privileged account - the CVSS vector is AV:L/PR:L. The attacker abuses a management interface/command that improperly neutralizes OS command special elements to escalate from low privilege to root. Limiting factors: exploitation is NOT remote or unauthenticated - an attacker must already have a valid low-privileged local/CLI session on the array, which substantially narrows the exposed population to environments with untrusted or shared operator accounts. No user interaction by another party is required (UI:N). |
| Impact | Signals align consistently toward a moderate, locally-scoped risk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity, authenticated privilege-escalation-to-root via OS command injection - not a remotely reachable flaw. EPSS is low at 0.51% (41st percentile), which is coherent with the local attack vector: mass automated exploitation is implausible because the attacker must already possess a low-privileged local foothold on the array. There is no CISA KEV listing and no public POC identified, so no evidence of active exploitation. The practical impact is significant where the precondition is met (full root on a storage array holding production data), but the AV:L gate keeps real-world exploitability contingent on prior access. No signals conflict: the description ('local access,' 'low privileged,' 'root privileges') matches the CVSS vector precisely. This is a genuine but bounded issue - high technical impact, low exposure - best prioritized for hosts where untrusted or semi-trusted local accounts exist, rather than as an emergency internet-facing patch. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged local/CLI account on a Dell Unity array (e.g., an operator or service account) supplies crafted input to a vulnerable management command that fails to neutralize shell metacharacters, causing injected commands to run as root. This yields full control of the storage appliance and the data it serves. No public exploit code has been identified; exploitation requires an existing local foothold. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
OS command injection in Dell Unity, UnityVSA, and Unity XT operating environment version 5.5 and prior allows a low-privileged, locally authenticated attacker to execute arbitrary OS commands with root privileges, escalating from an ordinary operator account to full control of the storage array. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires a pre-existing local session on the system and no interaction from another user. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; EPSS is 0.51% (41st percentile), indicating low near-term exploitation probability, though the impact of successful privilege escalation on a storage platform is high.
RemediationAI
Dell has released a security update addressing this issue; upgrade Dell Unity, UnityVSA, and Unity XT from version 5.5 (or earlier) to the fixed release specified in Dell advisory DSA-2025-379 (https://www.dell.com/support/kbdoc/en-us/000385307/dsa-2025-379-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities), which is the authoritative source for exact patched version numbers - the advisory maps each affected build to its remediation, so follow that matrix rather than assuming a generic version bump. Until the update is applied, reduce the exposed population by eliminating or tightly controlling shared and untrusted low-privileged operator accounts, since exploitation depends on possessing such a local session; restrict CLI and management-interface access to trusted administrators and management networks (e.g., dedicated out-of-band or jump-host paths), and enable detailed command auditing/alerting on privileged escalation from operator accounts. The trade-off of account tightening and network restriction is reduced operational flexibility for delegated storage administration, but it directly removes the PR:L precondition. Because this is a local privilege-escalation flaw with no identified public exploit code, patching during the next maintenance window is reasonable, while the account- and access-hardening measures should be treated as interim compensating controls rather than a substitute for the vendor update.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic OS command injection (CWE-78) in the Dell Unity operating environment, tracked by CPE cpe:2.3:a:dell:unity_operating_environment. CWE-78 covers improper neutralization of special elements used in an OS command, which in practice means user-supplied input - here passed through a management/CLI-facing function reachable by a low-privileged local account - is concatenated or otherwise incorporated into a shell command without adequate escaping or sanitization. Because the vulnerable component runs with elevated privileges, the injected metacharacters are interpreted by the underlying operating system and executed in a root context, converting a restricted operator session into full system compromise. The CVSS vector AV:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms the attack surface is local (AV:L), requires a valid low-privileged account (PR:L), needs no user interaction (UI:N), and yields high confidentiality, integrity, and availability impact within the same security scope. The relevant technology is the Unity/UnityVSA/Unity XT storage operating environment, a Linux-based array management stack, and the weakness sits in the boundary between its management interface and the host shell.
Know when Unity Operating Environment gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with an existing low-privileged account (AV:L/PR:L), straightforward injection (AC:L), and root command execution yielding full CIA impact (C:H/I:H/A:H).
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
DescriptionCVE.org
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
Executive ViewAI
Dell Unity, UnityVSA, and Unity XT storage arrays running operating environment version 5.5 and earlier contain a high-severity OS command injection vulnerability that allows a locally authenticated low-privileged attacker to escalate to root and gain full control of the storage system. This could lead to unauthorized data access, data loss, or disruption of critical storage services, affecting organizations relying on these platforms for business operations. No public exploit identified at time of analysis, but the potential for insider threat or compromised local accounts makes this a significant risk that warrants immediate mitigations.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting local access to the operating environment to trusted administrators, enforcing least privilege and strong authentication for local accounts, monitoring for suspicious command execution, and applying vendor-provided workarounds as they become available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)CVE.org
More in Unity Operating Environment
View allDell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication atte
Dell Unity, version(s) 5.4 and prior, contain(s) an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. R
Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
OS command injection in Dell Unity Operating Environment 5.5 and earlier lets an authenticated local user with low privi
OS command injection in Dell Unity, Unity XT, and UnityVSA running Unity Operating Environment 5.5 and earlier allows a
OS command injection in Dell Unity Operating Environment 5.5 and prior allows an authenticated local low-privileged atta
OS command injection in the Dell Unity Operating Environment (version 5.4 and prior) allows a locally authenticated, low
Command injection in Dell Unity Operating Environment (OE) 5.5 and prior lets an authenticated low-privileged attacker w
Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
GitHub PoC
Exploit-DB