CVE-2025-43941CWE-78command-injection

CVE-2025-43941

High · published October 30, 2025

CVSS v3.1
7.2
EPSS
1%
Percentile
52.3
In the wild
Unconfirmed
What it is

⚡ A local attack can lead to root access through a sneaky OS command injection! If that doesn't get your antennas up, I don't know what will! 😱 Think of it like a hotel guest who finds a way to trick the system into opening the safe in their room. With the right push of a button, they can access valuables they shouldn't even see! An attacker with low privileges could exploit this flaw to execute arbitrary commands with root privileges, potentially compromising sensitive data or even taking over the entire system! The consequences could be absolutely devastating if your Unity systems are left unprotected! 🔥

Put simply

Think of it like a hotel guest who finds a way to trick the system into opening the safe in their room. With the right push of a button, they can access valuables they shouldn't even see! This vulnerability in Dell Unity (versions 5.5 and prior) arises from improper handling of special elements in OS commands, allowing a local attacker to execute commands with elevated privileges if the system lacks a valid license.

What to do

An attacker with low privileges could exploit this flaw to execute arbitrary commands with root privileges, potentially compromising sensitive data or even taking over the entire system! The consequences could be absolutely devastating if your Unity systems are left unprotected! 🔥 To secure your systems, patch your Dell Unity to the latest version immediately! Make sure to enable proper licensing checks to prevent unauthorized command execution. Don’t let this vulnerability hang around! 🛡️ You've got this! Follow the steps, and you'll be the hero protecting your systems in no time! 💪😊

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00692 · 52.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-10-30T18:15Z
Affected products (1)
ProductVersionsFixed in
dell/unity_operating_environment< 5.5.2.05.5.2.0
References (1)
EPSS history
Timeline
  • 30 OCT 13:57Z
    Dell Unity, version(s) 5.5 and Prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability
    cvelistv5