CVE-2024-49601

Vulnerability

Dell Unity versions 5.4 and prior contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [1]. The flaw exists in an unspecified component that processes user-supplied input without proper sanitization, enabling injection of operating system commands.

Exploitation

An unauthenticated attacker with remote network access can exploit this vulnerability by sending specially crafted requests to the affected Dell Unity system [1]. No authentication or user interaction is required; the attacker can directly inject OS commands through the vulnerable input.

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system with the privileges of the affected process [1]. This can lead to full compromise of the Dell Unity system, including data disclosure, modification, or denial of service.

Mitigation

Dell has released a security update (DSA-2025-116) to address this vulnerability [1]. Affected users should apply the update as soon as possible. No workarounds have been provided; updating to a fixed version is the only recommended mitigation.