CVE-2025-36604

What it actually does

Dell Unity versions 5.5 and prior contain an unauthenticated remote OS command injection vulnerability. A remotely reachable attacker can submit specially crafted input that is not safely neutralized before being used in an operating-system command, causing the appliance to execute attacker-controlled commands with the privileges of the vulnerable service. Because the issue is unauthenticated and has a CVSS score of 9.8 with weaponized exploit maturity and high EPSS probability, exposed management interfaces should be treated as high-risk until upgraded or isolated.

Why it matters to the business

Successful exploitation can give an attacker control over a Dell Unity storage management appliance, potentially enabling disruption of storage services, theft or destruction of sensitive data, deployment of malware, lateral movement, and interruption of dependent business applications. Although it is not currently listed in CISA KEV and is not flagged as ransomware-used, the combination of unauthenticated remote code execution, weaponized exploitation, and elevated EPSS makes this an urgent operational risk for any internet-accessible or broadly reachable Dell Unity deployment.

How an attack unfolds

An attacker first identifies a Dell Unity appliance running version 5.5 or earlier, usually by scanning for exposed management services or fingerprinting the web/API interface. The attacker then sends a crafted unauthenticated request containing shell metacharacters or command payloads to a vulnerable input path. If the input is incorporated into an OS command without proper neutralization, the appliance executes the injected command. Initial commands commonly validate execution using simple probes such as id, uname, whoami, ping, curl, or wget. After confirming code execution, the attacker may download tooling, establish persistence, create or modify accounts, collect configuration and credential material, pivot toward storage-connected systems, exfiltrate data, or disrupt storage availability.

How to fix it

Upgrade affected Dell Unity systems running version 5.5 or prior to a vendor-supported fixed release as provided by Dell. If an exact fixed version is not available in the supplied asset data, consult the Dell security advisory for CVE-2025-36604 and apply the latest Unity OE update that remediates the command injection flaw. Until patched, restrict access to Dell Unity management interfaces to dedicated administrative networks or VPNs, block internet exposure, enforce firewall allowlists, disable unnecessary management services, monitor administrative access, and consider taking externally exposed vulnerable appliances offline until remediation is complete. Rotate credentials and review appliance configuration if exploitation is suspected.

How to confirm the fix worked

Confirm the installed Dell Unity version from the management interface, CLI, or vendor-supported inventory method and verify it is newer than the affected 5.5-and-prior range or explicitly listed by Dell as fixed. Validate that management interfaces are not exposed to untrusted networks and are reachable only from approved administrative sources. Use vulnerability scanners or authenticated configuration checks capable of identifying Dell Unity software versions, but avoid running intrusive proof-of-concept command-injection tests on production storage systems. After patching, review vendor update logs and appliance health status, then re-scan to ensure the vulnerable version is no longer detected.

Typical attack path

1. Scan for Dell Unity management interfaces exposed to the internet or reachable from internal networks.
2. Fingerprint the appliance version and identify systems running Dell Unity 5.5 or prior.
3. Send a crafted unauthenticated request containing OS command injection syntax.
4. Confirm command execution using benign output or outbound network callbacks.
5. Execute reconnaissance commands to determine privileges, network reachability, and appliance configuration.
6. Download or stage additional tooling using built-in utilities such as curl, wget, or shell redirection if available.
7. Attempt credential harvesting, account creation, persistence, lateral movement, data access, or destructive actions against storage services.

How to detect it

Review Dell Unity appliance audit, management, web/API, authentication, system, and support logs for unauthenticated requests followed by command execution, unexpected administrative changes, new users, configuration exports, service restarts, or appliance shell activity. Inspect reverse proxy, WAF, firewall, VPN, and load balancer logs for requests to Dell Unity management endpoints containing command separators, encoded shell metacharacters, or payloads invoking common Unix utilities. Look for outbound connections from the appliance to unfamiliar IP addresses or domains, especially immediately after suspicious HTTP requests. Investigate appliance processes or logs showing use of /bin/sh, bash, curl, wget, nc, ncat, python, perl, chmod, base64, crontab, or reverse-shell patterns. If exploitation is suspected, preserve appliance logs and support bundles, compare configuration and account state against a known-good baseline, review network flows for data transfer from the storage management plane, and rotate credentials after containment.

• ;id
• ; whoami
• ; uname -a
• |id
• | whoami
• `id`
• $(id)
• /bin/sh -c
• /bin/bash -c
• bash -i
• sh -i
• curl http
• curl -fsSL
• wget http
• wget -O
• nc -e
• ncat -e
• /dev/tcp/
• chmod +x
• base64 -d
• python -c
• perl -e
• crontab -e
• /tmp/
• /var/tmp/

What your security team should do

• Immediately inventory Dell Unity appliances and identify any running version 5.5 or prior.
• Prioritize remediation for any appliance with internet exposure, broad internal reachability, or access to critical storage workloads.
• Apply the Dell fixed update or latest supported Unity OE release that addresses the vulnerability.
• Restrict management-plane access with firewall allowlists, VPN, and administrative network segmentation while remediation is underway.
• Hunt for evidence of exploitation, especially unauthenticated requests containing shell metacharacters and follow-on commands such as curl, wget, nc, bash, sh, or chmod.
• Review appliance accounts, administrative sessions, configuration changes, scheduled tasks, and unexpected outbound connections.
• Rotate administrative credentials and relevant secrets if suspicious activity is identified.
• Increase monitoring of Dell Unity management logs and perimeter telemetry because exploit maturity is weaponized and EPSS is high.