CVE-2025-23383

Vulnerability

Dell Unity, including UnityVSA and Unity XT, versions 5.4 and prior, are affected by an OS command injection vulnerability (CVE-2025-23383). The software fails to properly neutralize special elements used in OS commands, enabling injection of arbitrary commands. The vulnerability is present in the product's codebase and requires local access to the system.

Exploitation

An attacker with low privileges and local access can exploit this vulnerability by crafting input that includes OS command special characters. The attacker does not need network access but must have a local shell or ability to interact with the vulnerable component. The exact attack vector is not detailed in available references, but the description confirms that command execution is achievable.

Impact

Successful exploitation allows the attacker to execute arbitrary OS commands with elevated privileges, leading to full compromise of the affected system. This results in loss of confidentiality, integrity, and availability, as the attacker can read, modify, or delete data and install persistent backdoors.

Mitigation

Dell has released a security update as part of DSA-2025-116 to address this vulnerability [1]. Users should apply the latest patches for Dell Unity, UnityVSA, and Unity XT. No workarounds are documented. Affected versions should be upgraded to a fixed release as soon as possible.