CVE-2025-22398CWE-78

Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability

Critical · published March 28, 2025

CVSS v3.1
9.8
EPSS
2%
Percentile
80.8
In the wild
Unconfirmed
What it is

🚨 Unauthenticated remote access? That’s the gateway to chaos! Dell Unity versions 5.4 and prior have a severe OS command injection vulnerability that allows attackers to execute commands as root. 🔥 Think of it like a restaurant where anyone can walk in and start cooking in the kitchen. They can mess up orders, change the menu, or even spoil the entire meal without anyone batting an eye! This vulnerability is absolutely devastating — an attacker could take full control of the operating system, leading to potential data breaches, service disruptions, and total system takeover! Imagine all your critical data at the mercy of a malicious intruder.

Put simply

Think of it like a restaurant where anyone can walk in and start cooking in the kitchen. They can mess up orders, change the menu, or even spoil the entire meal without anyone batting an eye! This vulnerability arises from improper neutralization of special elements, allowing attackers to send arbitrary commands through the system. In short, it creates a backdoor where attackers can do anything they want as if they were the admin.

What to do

This vulnerability is absolutely devastating — an attacker could take full control of the operating system, leading to potential data breaches, service disruptions, and total system takeover! Imagine all your critical data at the mercy of a malicious intruder. Dell strongly recommends upgrading to a fixed version immediately. Review your security policies, ensure only necessary access is given, and consider implementing additional firewalls or intrusion detection systems to bolster your defenses. You've got this! Follow the upgrade path and keep your systems secure. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02022 · 80.8th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-03-28T01:41Z
EPSS history
Timeline
  • 28 MAR 01:41Z
    Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability
    cvelistv5