Product:
Unity
Summary
Dell Unity, versions 5.5 and prior, contain an improper neutralization of special elements used in an OS command vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to command execution and elevation of privileges. This poses a significant risk to the integrity and confidentiality of the system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2025-43940 |
Exploitation
To exploit this vulnerability, an attacker with local access can craft specific OS commands that are improperly handled by the system. By executing these commands, the attacker can gain unauthorized access to system functions, potentially leading to privilege escalation and control over the affected system.
Affected Products
- Unity 5.5 and prior: Vulnerable to OS command injection, allowing local attackers to execute commands and elevate privileges.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Dell Unity that addresses this issue. Additionally, restricting local access to the system and monitoring for unusual command executions can help reduce the risk of exploitation.