CVE-2024-22223

Vulnerability

Dell Unity, Unity VSA, and Unity XT versions prior to 5.4 contain an OS command injection vulnerability in the svc_cbr utility. The utility is accessible to authenticated users with local access, and the injection occurs due to insufficient sanitization of user-supplied input when constructing system commands. [1]

Exploitation

An attacker must have local access to the system and valid authentication credentials. No user interaction is required. The attacker can craft input to the svc_cbr utility that, when processed, executes arbitrary OS commands with the privileges of the vulnerable application. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary operating system commands, leading to full compromise of confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.8 (High), with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. [1]

Mitigation

Dell has addressed this vulnerability in Unity version 5.4. Users should upgrade to 5.4 or later to remediate the issue. No workarounds are documented in the available reference. [1]