Introduction
Remote attackers can execute arbitrary operating system commands on unpatched Dell Unity storage systems, which puts enterprise data and infrastructure at risk. The vulnerability, tracked as CVE-2025-36604, affects Dell Unity, UnityVSA, and Unity XT platforms running version 5.5 and earlier. It is one of a cluster of critical issues disclosed in Dell Security Advisory DSA-2025-281.
About Dell Unity: Dell Technologies is one of the largest IT vendors in the world, with a big presence in enterprise storage, servers, and networking. Unity is its midrange storage line, used by thousands of organizations worldwide to run business-critical workloads and virtualized environments.
Technical Information
CVE-2025-36604 is an OS Command Injection vulnerability caused by improper neutralization of special elements in command construction. It exists in Dell Unity, UnityVSA, and Unity XT systems running version 5.5 and prior. An attacker with remote network access can exploit it by sending input that contains shell metacharacters or command separators to a vulnerable endpoint. The affected components do not properly validate or sanitize user-supplied input before they pass it to the operating system to execute. The attacker can then run arbitrary commands with the privileges of the affected service.
Key technical points:
- Vulnerability type: OS Command Injection (CWE-78)
- Attack vector: Remote network access
- Authentication: Not required
- Complexity: Low
- Impact: Arbitrary OS command execution
- Root cause: Insufficient input validation and sanitization in components that build system commands from user input
No public code snippets or proof of concept have been released for this vulnerability. Exploitation would typically involve sending specially crafted requests to the management interfaces or service endpoints that the affected Unity systems expose.
Patch Information
Dell Technologies has released a critical security update for Dell Unity, UnityVSA, and Unity XT systems that addresses multiple vulnerabilities, including CVE-2025-36604. (Dell Security Advisory DSA-2025-281)
Remediation Steps:
- Upgrade to Dell Unity Operating Environment (OE) version 5.5.1 or later.
- Check your current OE version in the management interface.
- Download the latest OE version from the Dell Unity Drivers & Downloads page.
- Follow the official installation instructions and confirm that the update succeeded.
- Review system logs and user access controls regularly.
Applying this update reduces the risk of exploitation for CVE-2025-36604 and the related vulnerabilities in the advisory.
Affected Systems and Versions
- Dell Unity, UnityVSA, and Unity XT systems running Operating Environment (OE) version 5.5 or any earlier version are vulnerable.
- Every configuration of these products on OE version 5.5 or earlier is affected.
- Systems upgraded to OE version 5.5.1 or later are not vulnerable to this issue.
Vendor Security History
Dell Technologies regularly publishes security advisories for its storage and infrastructure products. Earlier advisories have covered similar input validation and command injection issues in management interfaces and system utilities. Dell typically ships patches promptly, with detailed remediation guidance for disclosed vulnerabilities. Unity has had multiple advisories in recent years, which reflects how widely it is deployed and how much ongoing security work enterprise storage environments need.
