OS command injection in Dell Unity
Priority LOW 33CWE-78Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.
Summary
Dell Unity prior to 5.3 contains a Restricted Shell Bypass vulnerability. This could allow an authenticated, local attacker to exploit this vulnerability by authenticating to the device CLI and issuing certain commands.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00188 8th percentileScored 2026-11-07
Fix Fixed Unity (Dell): 5.3.0.0.5.120
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | Unity | before 5.3.0.0.5.120 | 5.3.0.0.5.120 | Patch available | CNA |
- Unity VendorDell Affected before 5.3.0.0.5.120 Fixed in 5.3.0.0.5.120 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dell:unity_operating_environment:*:*:*:*:*:*:*:* | before 5.3.0.0.5.120 | Vulnerable | Dell |
| cpe:2.3:a:dell:unity_xt_operating_environment:*:*:*:*:*:*:*:* | before 5.3.0.0.5.120 | Vulnerable | Dell |
| cpe:2.3:a:dell:unityvsa_operating_environment:*:*:*:*:*:*:*:* | before 5.3.0.0.5.120 | Vulnerable | Dell |
- cpe:2.3:a:dell:unity_operating_environment:*:*:*:*:*:*:*:* Versions before 5.3.0.0.5.120 Vulnerable ·Dell
- cpe:2.3:a:dell:unity_xt_operating_environment:*:*:*:*:*:*:*:* Versions before 5.3.0.0.5.120 Vulnerable ·Dell
- cpe:2.3:a:dell:unityvsa_operating_environment:*:*:*:*:*:*:*:* Versions before 5.3.0.0.5.120 Vulnerable ·Dell
Remediation
- Fix · CNA Unity (Dell) Fixed in 5.3.0.0.5.120
Timeline
- 2026-10-02 Threatist record created from CVE-2023-43066
- 2026-10-03 Alias added: GHSA-7mwm-qgvf-37wp
References
More Dell Unity Operating Environment vulnerabilities
- TI-2025-24909 OS command injection in Dell Unity CVSS 3.1CRITICAL 9.8
- TI-2025-16296 OS command injection in Dell Unity CVSS 3.1CRITICAL 9.8
- TI-2024-33087 OS command injection in Dell Unity CVSS 3.1CRITICAL 9.8
- TI-2025-18126 OS command injection in Dell Unity CVSS 3.1CRITICAL 9.1
- TI-2022-11638 Missing brute-force protection in Dell Unity CVSS 3.1CRITICAL 9.8
- TI-2025-18125 OS command injection in Dell Unity CVSS 3.1HIGH 7.3
Sources
- CVE-2023-43066 · CVE Program
- CVE-2023-43066 · NVD
- FIRST EPSS
- GHSA-7mwm-qgvf-37wp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences