CVE-2025-24383CWE-78

Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability

Critical · published March 28, 2025

CVSS v3.1
9.1
EPSS
1%
Percentile
67.1
In the wild
Unconfirmed
What it is

🚨 An unauthenticated remote attacker can execute a command that deletes any file they want! That's right, all it takes is a sneaky input to unleash chaos in Dell Unity versions 5.4 and earlier. 🔥 Think of it like an unmonitored janitor in a secured office who can toss out any document they don’t recognize — potentially shredding vital files that keep everything running smoothly. This vulnerability is absolutely devastating! An attacker could wipe out critical system files with root privileges, leading to catastrophic data loss and service downtime. The implications could cripple your operations, making this a top priority for any security hero. ⚡

Put simply

Think of it like an unmonitored janitor in a secured office who can toss out any document they don’t recognize — potentially shredding vital files that keep everything running smoothly. This OS Command Injection vulnerability allows an unauthenticated remote attacker to manipulate commands executed by the server, effectively granting them the ability to delete arbitrary files.

What to do

This vulnerability is absolutely devastating! An attacker could wipe out critical system files with root privileges, leading to catastrophic data loss and service downtime. The implications could cripple your operations, making this a top priority for any security hero. ⚡ Upgrade Dell Unity to a version beyond 5.4 immediately to close this gaping hole. Ensure that access policies are strictly enforced and monitor your systems for unauthorized access attempts. 🛡️ You've got this! Take these steps, and you’ll keep your systems safe and sound. 💪✨

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01168 · 67.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-03-28T01:24Z
EPSS history
Timeline
  • 28 MAR 01:24Z
    Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability
    cvelistv5