CVE-2025-24379
Published: 28 March 2025
Summary
CVE-2025-24379 is a high-severity OS Command Injection (CWE-78) vulnerability in Dell Unity Operating Environment. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 41.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates identification, reporting, and correction of the OS command injection flaw via Dell's security update, eliminating the vulnerability.
Requires validation of information inputs to OS commands, directly countering the improper neutralization of special elements that enables command injection.
Enforces least privilege to restrict the actions of the low-privileged local attacker and limit damage from privilege escalation post-exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection (CWE-78) directly enables arbitrary command execution on the local system via Unix Shell and facilitates privilege escalation via exploitation of the vulnerability.
NVD Description
Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation…
more
of privileges.
Deeper analysisAI
CVE-2025-24379 is an improper neutralization of special elements used in an OS command, classified as an OS Command Injection vulnerability (CWE-78), affecting Dell Unity storage systems in versions 5.4 and prior. Published on March 28, 2025, this flaw allows malicious input to alter intended OS commands executed by the system.
A low-privileged attacker with local access can exploit this vulnerability to achieve arbitrary command execution and privilege escalation. The CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impacts on confidentiality, integrity, and availability in a local attack scenario with low complexity and no user interaction required.
Dell has issued DSA-2025-116, a security update addressing this and multiple other vulnerabilities in Dell Unity, Dell UnityVSA, and Dell Unity XT systems. Practitioners should consult the advisory at https://www.dell.com/support/kbdoc/en-us/000300090/dsa-2025-116-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities for patch details and mitigation guidance.
Details
- CWE(s)