CVE-2025-36604
90Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 7.3epss 61%
from disclosure to weapon56 days
Published on NVDAug 4
1st PoC+56d
VulnCheck+66d
exploitation probability
61%top 1% of all CVEs
observed exploitation
yesVulnCheck
1 public exploit(s)
In short
Dell Unity storage systems versions 5.5 and earlier have a flaw that allows remote attackers to run arbitrary commands without authentication. An attacker could take complete control of the system.
Technical detail
An OS command injection vulnerability in Dell Unity ≤5.5 allows unauthenticated remote attackers to execute arbitrary OS commands through improper neutralization of special elements in user input. The vulnerability enables complete system compromise without requiring prior authentication or user interaction.
Summary generated and translated by AI from the official description.
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
Dell · Unitypublic PoCs found — 1
vulncheckvulncheck.com/xdb/c2f51ceac6cfunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://github.com/watchtowrlabs/watchTowr-vs-Dell-UnityVSA-PreAuth-CVE-2025-36604https://labs.watchtowr.com/its-never-simple-until-it-is-dell-unityvsa-pre-auth-command-injection-cve-2025-36604/https://www.dell.com/support/kbdoc/en-si/000350756/dsa-2025-281-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities