Introduction
An attacker with credentials to a Dell Unity storage system can escape the restricted shell and execute arbitrary commands as root. That puts the integrity and availability of enterprise storage environments on affected versions at risk. Dell Unity is a widely deployed enterprise storage platform that thousands of organizations use for data storage and management, and many large enterprises and service providers depend on it for their operations.
Technical Information
CVE-2025-36607 is an OS command injection vulnerability in the svc_nas utility of Dell Unity Operating Environment, affecting versions 5.5 and prior. The root cause is improper neutralization of special elements used in OS commands (CWE-78). An authenticated attacker can pass crafted input to the svc_nas utility, and the shell executes that input with root privileges. The attacker can then escape the restricted shell environment and run arbitrary commands as root on the underlying operating system.
The attacker needs local access and valid credentials. Once they have that, exploitation is low complexity and needs no user interaction. The vulnerability is not known to be remotely exploitable without authentication, but an attacker could chain it with other vulnerabilities or with compromised credentials.
No public code snippets or exploit samples are available at this time. The vulnerability is closely related to other command injection issues recently disclosed in Dell Unity: one in the svc_nfssupport utility (CVE-2025-36606) and an unauthenticated remote command injection in other components (CVE-2025-36604).
Patch Information
Dell Technologies has released an updated version of the Dell Unity Operating Environment (OE) that fixes multiple security vulnerabilities in Dell Unity, UnityVSA, and Unity XT systems. (dell.com)
Fixes in Version 5.5.1:
-
OS Command Injection Vulnerabilities:
- CVE-2025-36604: Fixed an issue that let unauthenticated remote attackers execute arbitrary commands.
- CVE-2025-36606 & CVE-2025-36607: Fixed vulnerabilities in the
svc_nfssupportandsvc_nasutilities that let authenticated users escape the restricted shell and execute commands with root privileges.
-
Cross-Site Scripting (XSS) Vulnerability:
- CVE-2025-36605: Fixed a flaw that let unauthenticated attackers inject malicious scripts, which could lead to information disclosure or session theft.
Recommendations:
Upgrade promptly to Dell Unity OE version 5.5.1 or later to fix these vulnerabilities. The updated firmware is available for download on Dell's official support page. (dell.com)
Upgrade Steps:
- Back up all critical data before you start the upgrade.
- Read the release notes to understand the changes and improvements.
- Download the latest firmware version from the Dell support portal.
- Follow Dell's official upgrade procedures.
Affected Systems and Versions
- Dell Unity Operating Environment versions 5.5 and prior
- All configurations where the
svc_nasutility is present and accessible - Dell UnityVSA and Dell Unity XT systems running affected OE versions
Vendor Security History
Dell Unity has had a series of command injection vulnerabilities in 2025, including:
- CVE-2025-36604: Unauthenticated remote OS command injection
- CVE-2025-36606: Authenticated OS command injection in
svc_nfssupport - CVE-2025-22398: Critical unauthenticated command execution vulnerability (March 2025)
Dell has responded with coordinated security advisories and timely patches. Still, similar vulnerabilities keep appearing in core utilities, which suggests the product line has ongoing problems with input validation and secure coding practices.
