CVE-2025-36606
📋 TL;DR
Dell Unity storage systems running version 5.5 and earlier contain an OS command injection vulnerability in the svc_nfssupport utility. Authenticated attackers can escape the restricted shell and execute arbitrary commands with root privileges. This affects organizations using Dell Unity storage appliances for data management.
💻 Affected Systems
- Dell Unity
- Dell UnityVSA
- Dell Unity XT
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands as root, potentially leading to data theft, system destruction, or lateral movement to other network resources.
Likely Case
Privilege escalation from authenticated user to root, enabling attackers to modify configurations, access sensitive data, or disrupt storage operations.
If Mitigated
Limited impact if proper network segmentation, least privilege access, and monitoring are implemented to detect and block exploitation attempts.
🎯 Exploit Status
Exploitation requires authenticated access but command injection vulnerabilities are typically straightforward to exploit once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply patches referenced in DSA-2025-281
Restart Required: Yes
Instructions:
1. Review Dell advisory DSA-2025-281. 2. Download appropriate patches from Dell Support. 3. Apply patches following Dell's documented procedures. 4. Restart affected systems as required.
🔧 Temporary Workarounds
Restrict Access to Management Interface
allLimit network access to Dell Unity management interfaces to only trusted administrative networks.
Implement Least Privilege Access
allReview and restrict user accounts with access to Dell Unity systems to only necessary personnel.
🧯 If You Can't Patch
- Isolate Dell Unity systems on dedicated network segments with strict firewall rules
- Implement comprehensive monitoring and alerting for suspicious command execution patterns
🔍 How to Verify
Check if Vulnerable:
Check Dell Unity version via management interface or CLI. Versions 5.5 and earlier are vulnerable.Check Version:
Check version via Dell Unity Unisphere interface or consult system documentation for CLI commands.Verify Fix Applied:
Verify patch installation through Dell Unity management interface and confirm version is updated beyond 5.5.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns in system logs
- Multiple failed authentication attempts followed by successful login
- Unexpected process execution with root privileges
Network Indicators:
- Unusual network traffic from Dell Unity management interfaces
- Suspicious connections to command and control infrastructure
SIEM Query:
source="dell_unity" AND (event_type="command_execution" OR user="root") AND command CONTAINS suspicious_pattern