Product:
Dell Unity
Summary
Dell Unity, versions 5.4 and prior, contain an Improper Neutralization of Special Elements used in an OS Command vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to command execution and elevation of privileges. This vulnerability poses a significant risk due to its high impact on confidentiality, integrity, and availability.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2025-43939 |
Exploitation
To exploit this vulnerability, an attacker with local access can craft specific OS commands that are improperly handled by the system. By executing these commands, the attacker can gain unauthorized access to system functions, potentially leading to command execution and privilege escalation. The low attack complexity makes it easier for attackers to exploit this vulnerability if they have local access.
Affected Products
- Dell Unity 5.4 and prior: Vulnerable to OS command injection, allowing local attackers to execute commands and escalate privileges.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Dell Unity that addresses this issue. Additionally, restricting local access to the system can help reduce the risk of exploitation. Regular security updates and monitoring for unusual activity are also recommended to enhance overall security.