CVE-2025-24385

Vulnerability

Dell Unity, UnityVSA, and Unity XT versions 5.4 and prior are affected by an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability. This flaw allows a low-privileged attacker with local access to inject arbitrary OS commands into vulnerable inputs [1].

Exploitation

The attacker requires local access with low privileges. By crafting malicious input that includes OS command separators or special characters, the attacker can execute arbitrary commands on the underlying system. No user interaction beyond initial access is required [1].

Impact

Successful exploitation leads to arbitrary code execution and elevation of privileges, potentially granting the attacker full administrative control over the affected Dell Unity system. This can result in complete compromise of confidentiality, integrity, and availability [1].

Mitigation

Dell has released a security update (DSA-2025-116) to address this vulnerability. Users are advised to apply the patch to the latest available version. No workarounds have been documented. The vulnerability is not known to be listed in CISA's Known Exploited Vulnerabilities (KEV) catalog [1].