CVE-2025-36604
📋 TL;DR
This CVE describes an OS command injection vulnerability in Dell Unity storage systems. Unauthenticated remote attackers can execute arbitrary commands on affected systems, potentially gaining full control. Systems running Dell Unity version 5.5 and earlier are vulnerable.
💻 Affected Systems
- Dell Unity
- Dell UnityVSA
- Dell Unity XT
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to execute arbitrary commands, exfiltrate data, deploy ransomware, or pivot to other network systems.
Likely Case
Initial foothold leading to data theft, credential harvesting, and lateral movement within the storage environment.
If Mitigated
Limited impact if systems are isolated, patched, or have network controls preventing unauthenticated access.
🎯 Exploit Status
Public exploit code and detailed analysis available from watchTowr Labs. Exploitation requires network access but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 5.5 with security updates or later
Restart Required: Yes
Instructions:
1. Download the latest security update from Dell Support. 2. Apply the patch following Dell's update procedures. 3. Reboot the system as required. 4. Verify the update was successful.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to Dell Unity management interfaces to trusted IPs only
Firewall Rules
allBlock external access to Unity management ports (typically 443/TCP)
🧯 If You Can't Patch
- Isolate affected systems from internet and untrusted networks
- Implement strict network access controls and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check system version via Unity management interface or CLI. If version is 5.5 or earlier, system is vulnerable.Check Version:
Check via Unity web interface or use 'show version' in Unity CLIVerify Fix Applied:
Verify system version is updated to patched version and test that command injection attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns
- Multiple failed authentication attempts followed by successful command execution
- Suspicious process creation
Network Indicators:
- Unusual outbound connections from Unity systems
- Traffic to known malicious IPs
- Anomalous patterns in management interface traffic
SIEM Query:
source="unity_logs" AND ("command injection" OR "os command" OR suspicious_command_pattern)🔗 References
- https://www.dell.com/support/kbdoc/en-si/000350756/dsa-2025-281-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
- https://github.com/watchtowrlabs/watchTowr-vs-Dell-UnityVSA-PreAuth-CVE-2025-36604
- https://labs.watchtowr.com/its-never-simple-until-it-is-dell-unityvsa-pre-auth-command-injection-cve-2025-36604/
