CVE-2024-0170 is a high severity (CVSS 7.8) command injection in the svc_cava utility of Dell Unity, Unity VSA and Unity XT before OE version 5.4. An authenticated attacker could potentially use it for escaping the restricted shell and running arbitrary operating system commands with root privileges. Dell fixed it in Unity OE 5.4.0.0.5.094 and later.
What's affected
Dell advisory DSA-2024-042 lists Dell Unity Operating Environment versions prior to 5.4 as affected. The fixed version is 5.4.0.0.5.094 or later. The advisory covers Dell Unity, Unity VSA and Unity XT.
This is one of several flaws fixed in the same advisory. In this range of CVE numbers it sits with CVE-2024-0164, CVE-2024-0165, CVE-2024-0166, CVE-2024-0167, CVE-2024-0168, which are command injection issues in other service utilities, and the advisory also covers a cross-site scripting issue in the web interface that affects 5.3 and earlier.
How to check if you're exposed
Find the Unity operating environment version in Unisphere, under the software update or system view, or through your usual Dell support tooling. Compare it with the fixed build, 5.4.0.0.5.094.
Anything below 5.4 is affected. Also review who has authenticated access to the array, because the attacker must be logged in. Check service and administrator accounts, and confirm no shared credentials are in use.
What to do now
- List all Unity, Unity VSA and Unity XT systems and their OE versions.
- Plan an upgrade to Unity OE 5.4.0.0.5.094 or later, following Dell upgrade guidance.
- Review and trim accounts that can sign in to the array and its service interfaces.
- Restrict management network access to trusted admin hosts.
- Check logs on the array for unexpected use of service utilities, then record the post-upgrade version.
Why it matters
The record classifies this as CWE-78, OS command injection. A program builds an operating system command from input and does not neutralise it first, so extra command content can run. Dell describes OS command injection in svc_cava that escapes the restricted shell, and says the result could be escaping the restricted shell and running arbitrary operating system commands with root privileges.
The vector is local with low complexity and low privileges, and the record shows no exploitation in the wild. Storage arrays hold the data other systems depend on, and root on the array is a serious position. That makes patching worth doing even when only trusted staff have logins. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan, and the Gold directory lists the CVE and CWE pages used here.
Quick check
Does the attacker need to log in?
Yes. Dell describes an authenticated attacker, and the vector requires low privileges.
Is this the same as the other Unity CVEs in the advisory?
They share a fix. Each CVE covers a different utility or component, and Unity OE 5.4.0.0.5.094 addresses them together.
Sources
Last reviewed: 19 October 2026.
