TI-2025-28509 Aliases CVE-2025-43943 GHSA-xchv-gqgx-v2vx

OS command injection in Dell Cloud Disaster Recovery

LOW 33CWE-78Published 2025-09-25 · Updated 2025-09-25

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Dell Cloud Disaster Recovery, version(s) prior to 19.20, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00853 58th percentileScored 2026-11-07

Fix Fixed Cloud Disaster Recovery (Dell): 19.20

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dell	Cloud Disaster Recovery	N/A to before 19.20	19.20	Patch available	CNA

Cloud Disaster Recovery VendorDell Affected N/A to before 19.20 Fixed in 19.20 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:dell:cloud_disaster_recovery::::::::	before 19.20	Vulnerable	Dell

cpe:2.3:a:dell:cloud_disaster_recovery:*:*:*:*:*:*:*:* Versions before 19.20 Vulnerable ·Dell

Remediation

Fix · CNA Cloud Disaster Recovery (Dell) Fixed in 19.20

Timeline

2026-10-02 Threatist record created from CVE-2025-43943
2026-10-03 Alias added: GHSA-xchv-gqgx-v2vx
2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 1

https://www.dell.com/support/kbdoc/en-us/000372457/dsa-2025-354-security-update-for-dell-cloud-disaster-recovery-rce-vulnerability

TI-2026-49195 OS command injection in Dell Cloud Disaster Recovery CVSS 3.1CRITICAL 9.1
TI-2026-49859 OS command injection in Dell Cloud Disaster Recovery CVSS 3.1HIGH 7.2
TI-2026-49860 Server-side request forgery in Dell Cloud Disaster Recovery CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences