CVE-2025-23383

CVE-2025-23383 is an Improper Neutralization of Special Elements used in an OS Command, classified as an OS Command Injection vulnerability (CWE-78), affecting Dell Unity storage systems in versions 5.4 and prior. Published on 2025-03-28, this flaw allows special elements in OS commands to be inadequately sanitized, enabling malicious input to alter command execution.

A low-privileged attacker with local access can exploit CVE-2025-23383 to achieve arbitrary command execution and privilege escalation. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting high impacts on confidentiality, integrity, and availability in a local attack scenario with low complexity and no user interaction required.

Dell's security advisory DSA-2025-116 details a security update addressing multiple vulnerabilities, including CVE-2025-23383, in Dell Unity, Dell UnityVSA, and Dell Unity XT systems. Security practitioners should review the advisory at https://www.dell.com/support/kbdoc/en-us/000300090/dsa-2025-116-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities for patch deployment and mitigation guidance.