CVE-2025-36604

Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.

Affected

Dell · Unity

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 EMC

7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS

66.43% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-78

Published

2025-08-04

Updated

2026-02-26

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-36604.yaml

Security advisories

• https://www.dell.com/support/kbdoc/en-si/000350756/dsa-2025-281-security-update-for-dell-…

References

• CVE Record
• NVD entry