PT-2025-31809 · Dell · Dell Unity

Sina Kheirkhah + 1 · Published 2025-08-04 · Updated 2026-01-29 · CVE-2025-36604

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell Unity versions prior to 5.5.1 Dell UnityVSA versions prior to 5.5.1

Description Dell Unity and UnityVSA contain an Improper Neutralization of Special Elements used in an OS Command vulnerability, also known as OS Command Injection. An unauthenticated, remote attacker could potentially exploit this issue to execute arbitrary commands on the system. The vulnerability stems from improper handling of login redirect URIs, allowing an attacker to insert shell metacharacters into a command execution string during the redirect process. This could lead to unauthorized configuration changes, data access, or complete control over the appliance.

Recommendations Upgrade to version 5.5.1 or later to address this vulnerability.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-36604

Affected Products

Dell Unity

References · 27

• 🔥 https://github.com/watchtowrlabs/watchTowr-vs-Dell-UnityVSA-PreAuth-CVE-2025-36604 · Exploit
• https://dell.com/support/kbdoc/en-si/000350756/dsa-2025-281-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-36604 · Security Note
• https://osv.dev/vulnerability/CVE-2025-36604 · Vendor Advisory
• https://t.me/RNetsec/22056 · Telegram Post
• https://t.me/secharvester/20271 · Telegram Post
• https://twitter.com/eyalestrin/status/1975472734999355756 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/1974474623292199084 · Twitter Post
• https://t.me/CSIRT_italia/2777 · Telegram Post
• https://t.me/CyberSecurityTechnologies/12423 · Telegram Post
• https://twitter.com/ksg93rd/status/1974514765494997088 · Twitter Post
• https://t.me/CVEtracker/29085 · Telegram Post
• https://twitter.com/samilaiho/status/1975175709610959351 · Twitter Post
• https://twitter.com/reverseame/status/2016946238516605406 · Twitter Post
• https://twitter.com/cracbot/status/1954135620055449758 · Twitter Post