VulnerabilityAnalyzed

CVE-2025-43943

Dell Cloud Disaster Recovery, version(s) prior to 19.20, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability.

MEDIUM 6.7EPSS 0.46%

Does this matter?

Lower severity and a low EPSS score (0.46%). Track it; it rarely justifies an emergency change on its own.

Description

Dell Cloud Disaster Recovery, version(s) prior to 19.20, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges.

CVSS 3.1: 6.7 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.46% probability · 39th percentile
CISA KEV: Not listed
Weakness: CWE-78
Affected: dell/cloud disaster recovery
Source: security_alert@emc.com

References

https://www.dell.com/support/kbdoc/en-us/000372457/dsa-2025-354-security-update-for-dell-cloud-disaster-recovery-rce-vulnerabilityVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.