VulnerabilityAnalyzed

CVE-2025-22398

Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability.

CRITICAL 9.8EPSS 2.02%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.02%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution as root. Exploitation may lead to a system take over by an attacker. This vulnerability is considered critical as it can be leveraged to completely compromise the operating system. Dell recommends customers to upgrade at the earliest opportunity.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 2.02% probability · 80th percentile
CISA KEV: Not listed
Weakness: CWE-78
Affected: dell/unity operating environment
Source: security_alert@emc.com

References

https://www.dell.com/support/kbdoc/en-us/000300090/dsa-2025-116-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilitiesVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.