CVE-2025-24377
Published: 28 March 2025
Summary
CVE-2025-24377 is a high-severity OS Command Injection (CWE-78) vulnerability in Dell Unity Operating Environment. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 36.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly addresses the OS command injection vulnerability by applying Dell's security update to patch the improper neutralization of special elements.
Information input validation neutralizes special elements in inputs to OS commands, directly preventing exploitation of the command injection flaw.
Least privilege limits the scope of privileges available to the low-privileged local attacker, mitigating the impact of code execution and privilege escalation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection (CWE-78) directly enables arbitrary command execution (T1059) by a local low-privileged attacker, which is exploited for privilege escalation (T1068).
NVD Description
Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation…
more
of privileges.
Deeper analysisAI
CVE-2025-24377, published on 2025-03-28, is an Improper Neutralization of Special Elements used in an OS Command vulnerability, classified under CWE-78, affecting Dell Unity versions 5.4 and prior. This OS command injection flaw carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
A low-privileged attacker with local access to the system could exploit this vulnerability to execute arbitrary code and elevate privileges, potentially gaining higher-level control over the affected Dell Unity instance.
Dell's security advisory DSA-2025-116 provides a security update addressing this and multiple other vulnerabilities in Dell Unity, Dell UnityVSA, and Dell Unity XT, available at https://www.dell.com/support/kbdoc/en-us/000300090/dsa-2025-116-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities.
Details
- CWE(s)