Read the docs
TI-2022-11638 Aliases CVE-2022-29084GHSA-x6g3-9cv4-7822

Missing brute-force protection in Dell Unity

Priority MEDIUM 46CWE-307Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-307.

Summary

Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication attempts in Unisphere GUI. A remote unauthenticated attacker may potentially exploit this vulnerability to brute-force passwords and gain access to the system as the victim. Account takeover is possible if weak passwords are used by users.

Why it matters now

EPSS 0.02026 81st percentileScored 2026-11-07
Fix Fixed Unity (Dell): 5.2.0.0.5.173

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellUnitybefore 5.2.0.0.5.1735.2.0.0.5.173Patch availableCNA
  • Unity VendorDell Affected before 5.2.0.0.5.173 Fixed in 5.2.0.0.5.173 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:dell:unity_operating_environment:*:*:*:*:*:*:*:*before 5.2.0.0.5.173VulnerableDell
cpe:2.3:a:dell:unity_xt_operating_environment:*:*:*:*:*:*:*:*before 5.2.0.0.5.173VulnerableDell
cpe:2.3:a:dell:unityvsa_operating_environment:*:*:*:*:*:*:*:*before 5.2.0.0.5.173VulnerableDell
  • cpe:2.3:a:dell:unity_operating_environment:*:*:*:*:*:*:*:* Versions before 5.2.0.0.5.173 Vulnerable ·Dell
  • cpe:2.3:a:dell:unity_xt_operating_environment:*:*:*:*:*:*:*:* Versions before 5.2.0.0.5.173 Vulnerable ·Dell
  • cpe:2.3:a:dell:unityvsa_operating_environment:*:*:*:*:*:*:*:* Versions before 5.2.0.0.5.173 Vulnerable ·Dell

Remediation

  • Fix · CNA Unity (Dell) Fixed in 5.2.0.0.5.173

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Dell Unity 5.2.0.0.5.173

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2022-11639 Insufficiently protected credentials in Dell UnityPriority LOW 29
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-29084
  2. 2026-10-03 Alias added: GHSA-x6g3-9cv4-7822

References

Advisory 1

  • TI-2025-24909 OS command injection in Dell Unity CVSS 3.1CRITICAL 9.8
  • TI-2025-16296 OS command injection in Dell Unity CVSS 3.1CRITICAL 9.8
  • TI-2024-33087 OS command injection in Dell Unity CVSS 3.1CRITICAL 9.8
  • TI-2025-18126 OS command injection in Dell Unity CVSS 3.1CRITICAL 9.1
  • TI-2025-18125 OS command injection in Dell Unity CVSS 3.1HIGH 7.3
  • TI-2025-18124 Open redirect in Dell Unity CVSS 3.1HIGH 8.8
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences