{"id":"CVE-2025-36604","aliases":["EUVD-2025-23501","GHSA-g5wq-c47p-2h9f"],"status":"published","title":"Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements...","description":"Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.69197,"percentile":0.9936,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-78"],"published":"2025-08-04T14:00:05Z","modified":"2026-06-17T09:14:51Z","exploits":[{"source":"nuclei","id":"CVE-2025-36604","title":"Dell UnityVSA \u003c 5.5 - Remote Command Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-36604.yaml"},{"source":"pocgithub","id":"watchtowrlabs/watchTowr-vs-Dell-UnityVSA-PreAuth-CVE-2025-36604","title":"watchtowrlabs/watchTowr-vs-Dell-UnityVSA-PreAuth-CVE-2025-36604","date":"2025-09-29","url":"https://github.com/watchtowrlabs/watchTowr-vs-Dell-UnityVSA-PreAuth-CVE-2025-36604"}],"products":[{"vendor":"dell","product":"unity"},{"vendor":"dell","product":"unity_operating_environment"}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-si/000350756/dsa-2025-281-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://labs.watchtowr.com/its-never-simple-until-it-is-dell-unityvsa-pre-auth-command-injection-cve-2025-36604/","tags":["technical-description"]},{"url":"https://github.com/watchtowrlabs/watchTowr-vs-Dell-UnityVSA-PreAuth-CVE-2025-36604","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-36604"},{"url":"https://labs.watchtowr.com/its-never-simple-until-it-is-dell-unityvsa-pre-auth-command-injection-cve-2025-36604"},{"url":"https://github.com/advisories/GHSA-g5wq-c47p-2h9f"}],"sources":{"cve":[{"id":"CVE-2025-36604","description":"Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.","status":"published","published":"2025-08-04T14:00:05.295Z","modified":"2026-02-26T17:50:01.164Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:32:45.503988Z"}],"euvd":[{"id":"EUVD-2025-23501","description":"Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.","status":"published","published":"2025-08-04T14:00:05Z","modified":"2026-02-26T17:50:01Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T19:48:19.878708Z"}],"ghsa":[{"id":"GHSA-g5wq-c47p-2h9f","title":"Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements...","description":"Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.","status":"published","published":"2025-08-04T15:31:22Z","modified":"2025-10-03T15:32:20Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:03:51.355149Z"}],"nvd":[{"id":"CVE-2025-36604","description":"Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.","status":"published","published":"2025-08-04T14:15:32.507Z","modified":"2026-06-17T09:14:51.23Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:11:21.71471Z"}]}}