7.3Alta
CVE-2025-36604
Descripción
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.
Debilidad (CWE):
CWE-78
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Dell | Unity | N/A – < 5.5.1 | |
| dell | unity operating environment | < 5.5.1.0 |
Referencias y parches
- https://www.dell.com/support/kbdoc/en-si/000350756/dsa-2025-281-security-update-for-dell-unity-dell-unityvsa-… vendor-advisoryVendor Advisory
- https://github.com/watchtowrlabs/watchTowr-vs-Dell-UnityVSA-PreAuth-CVE-2025-36604
- https://labs.watchtowr.com/its-never-simple-until-it-is-dell-unityvsa-pre-auth-command-injection-cve-2025-36604/
Coincidencias CPE (NVD) (1)
cpe:2.3:a:dell:unity_operating_environment:*:*:*:*:*:*:*:*< 5.5.1.0