Read the docs
TI-2018-01144 Aliases CVE-2018-1239GHSA-vprp-mqwj-m22m

OS command injection in Dell EMC Unity Operating Environment

Priority LOW 37CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968 are affected by multiple OS command injection vulnerabilities. A remote application admin user could potentially exploit the vulnerabilities to execute arbitrary OS commands as system root on the system where Dell EMC Unity is installed.

Why it matters now

EPSS 0.03265 88th percentileScored 2026-11-07
Fix Fixed Unity Operating Environment (OE) (Dell EMC): 4.3.0.1522077968

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Dell EMCUnity Operating Environment (OE)before 4.3.0.15220779684.3.0.1522077968Patch availableCNA
  • Unity Operating Environment (OE) VendorDell EMC Affected before 4.3.0.1522077968 Fixed in 4.3.0.1522077968 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:dell:emc_unity_operating_environment:*:*:*:*:*:*:*:*before 4.3.0.1522077968VulnerableDell
cpe:2.3:a:dell:emc_unityvsa_operating_environment:*:*:*:*:*:*:*:*before 4.3.0.1522077968VulnerableDell
  • cpe:2.3:a:dell:emc_unity_operating_environment:*:*:*:*:*:*:*:* Versions before 4.3.0.1522077968 Vulnerable ·Dell
  • cpe:2.3:a:dell:emc_unityvsa_operating_environment:*:*:*:*:*:*:*:* Versions before 4.3.0.1522077968 Vulnerable ·Dell

Remediation

  • Fix · CNA Unity Operating Environment (OE) (Dell EMC) Fixed in 4.3.0.1522077968

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1239
  2. 2026-10-03 Alias added: GHSA-vprp-mqwj-m22m

References

Advisory 1

  • TI-2018-01128 Missing authorization in Dell EMC Avamar, Integrated Data Protection Appliance CVSS 3.0CRITICAL 9.8
  • TI-2018-01141 OS command injection in Dell EMC RecoverPoint CVSS 3.0CRITICAL 9.8
  • TI-2018-07852 Dell EMC Avamar and Integrated Data Protection Appliance Remote Code Execution Vulnerability CVSS 3.0CRITICAL 9.8
  • TI-2017-05620 EMC Networker Remote Code Execution Vulnerability CVSS 3.0CRITICAL 9.8
  • TI-2018-11243 Dell EMC ESRS Policy Manager versions 6.8 and prior contain a remote code execution… CVSS 3.0CRITICAL 9.8
  • TI-2017-08041 OS command injection in Dell EMC Data Protection Advisor CVSS 3.1HIGH 8.8
See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences