CVE-2025-36604

Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.

Score

CVSS 3.1 9.8 Critical

Status

Modified - security_alert@emc.com

Published

2025-08-04

Last modified

2026-02-26

Weaknesses

CWE-78

Affected products

• Unity (Dell)
• Unity Operating Environment (Dell)

References

• https://www.dell.com/support/kbdoc/en-si/000350756/dsa-2025-281-security-update-for-dell-unity-dell-unityvsa-and-dell-u…
• https://github.com/watchtowrlabs/watchTowr-vs-Dell-UnityVSA-PreAuth-CVE-2025-36604
• https://labs.watchtowr.com/its-never-simple-until-it-is-dell-unityvsa-pre-auth-command-injection-cve-2025-36604/