CVE-2025-24381

Vulnerability

Dell Unity versions 5.4 and prior contain an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. The vulnerability exists in the web interface, allowing an attacker to craft a URL that redirects a user to an arbitrary external site. No authentication is required to trigger the redirect, but user interaction (clicking a link) is necessary.

Exploitation

An unauthenticated attacker with remote network access can craft a malicious link that appears to originate from a legitimate Dell Unity instance. When a targeted user clicks the link, they are redirected to an attacker-controlled website. The attacker can use this to conduct phishing attacks, tricking users into entering credentials or other sensitive information.

Impact

Successful exploitation allows the attacker to redirect users to arbitrary web URLs. This can lead to disclosure of sensitive information (e.g., credentials) and session theft if the user is authenticated to the Dell Unity system. The impact is primarily on confidentiality and integrity of user data.

Mitigation

Dell has released a security update (DSA-2025-116) to address this vulnerability. Users should upgrade to the latest fixed version as specified in the advisory [1]. No workarounds are mentioned; applying the update is the recommended mitigation.