BaseFortify

Publication date: 2025-10-30

Last updated on: 2025-11-03

Assigner: Dell

Description

Dell Unity, version(s) 5.5 and Prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-30

Last Modified

2025-11-03

Generated

2026-07-06

AI Q&A

2025-10-30

EPSS Evaluated

2026-07-05

NVD

CVE-2025-43940

Affected Vendors & Products

Vendor	Product	Version / Range
dell	unity_operating_environment	to 5.5.2.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability in Dell Unity versions 5.5 and prior is an OS Command Injection flaw where a low privileged attacker with local access can exploit improper neutralization of special elements to execute arbitrary commands on the operating system and elevate their privileges.

Impact Analysis

Exploitation of this vulnerability can lead to an attacker executing arbitrary OS commands and gaining elevated privileges, potentially compromising the system's confidentiality, integrity, and availability.

Hi! I’m here to help you understand CVE-2025-43940. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70