CVE-2025-22398

Vulnerability

CVE-2025-22398 is an OS command injection vulnerability in Dell Unity, Dell UnityVSA, and Dell Unity XT storage systems running version 5.4 and prior. The issue stems from improper neutralization of special elements used in an OS command, allowing an attacker to inject arbitrary commands through a vulnerable endpoint. No authentication is required to reach the vulnerable code path.

Exploitation

An unauthenticated attacker with network access to the affected Dell Unity system can exploit this vulnerability by sending specially crafted requests to the vulnerable functionality. The attacker does not need any prior credentials or user interaction. The injection occurs in a context that executes commands with root privileges.

Impact

Successful exploitation grants the attacker arbitrary command execution as root on the underlying operating system. This can lead to complete compromise of the storage system, including unauthorized access to all data, modification or deletion of files, installation of persistent backdoors, and potential lateral movement within the network.

Mitigation

Dell has released a security update as part of DSA-2025-116 [1] to address this vulnerability. Customers are advised to upgrade to a fixed version of Dell Unity software as soon as possible. No workarounds are currently available. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of publication.