CVE-2025-36604

Published Aug 4, 2025

Last updated a year ago

Dell Unity

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-36604 refers to an OS Command Injection vulnerability found in Dell Unity versions 5.5 and prior. An unauthenticated attacker with remote access could exploit this vulnerability, potentially leading to arbitrary command execution. Specifically, the vulnerability lies in the `svc_nfssupport` utility of Dell Unity. This vulnerability can be exploited by an unauthenticated attacker to escape the restricted shell and execute arbitrary operating system commands with root privileges.

Description: Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.
Source: security_alert@emc.com
NVD status: Modified
Products: unity_operating_environment

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security_alert@emc.com: CWE-78

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:dell:unity_operating_environment:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "1C908C3A-7827-4AD2-9FCB-EAB754928E10",
            "versionEndExcluding": "5.5.1.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.