CVE-2025-22398

Published Mar 28, 2025

Last updated 6 days ago

Dell Unity

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-22398 is a command injection vulnerability affecting Dell Unity, UnityVSA, and Unity XT systems version 5.4 and earlier. An unauthenticated attacker with remote access could exploit this vulnerability to execute arbitrary operating system commands as root. Specifically, the vulnerability stems from improper neutralization of special elements used in OS commands, allowing attackers to inject malicious commands through network requests to the Unity API. Successful exploitation could lead to a complete system takeover, potentially enabling ransomware deployment, data exfiltration, and persistent backdoor installation.

Description: Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution as root. Exploitation may lead to a system take over by an attacker. This vulnerability is considered critical as it can be leveraged to completely compromise the operating system. Dell recommends customers to upgrade at the earliest opportunity.
Source: security_alert@emc.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security_alert@emc.com: CWE-78

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 1

Overview

AI description

Risk scores

CVSS 3.1

Weaknesses

Social media

References