CVE-2024-49601 is a high severity (CVSS 7.3) OS command injection in Dell Unity operating environment version 5.4 and prior. An unauthenticated attacker with remote access could potentially run commands. Dell covers it in security advisory DSA-2025-116, so read that for the fixed version and apply it.
What's affected
The record says Dell Unity version 5.4 and prior contain the flaw. Dell publishes the fix in DSA-2025-116, titled as a security update for Dell Unity, Dell UnityVSA and Dell Unity XT.
The Dell support page could not be retrieved during review, so this post does not state the fixed version. Read the advisory for the exact release and the list of other vulnerabilities fixed in the same update.
Unity, UnityVSA and Unity XT are storage systems, so they often hold important data and sit on management networks that many staff can reach.
How to check if you're exposed
Open Unisphere and read the operating environment version, or use the Unity CLI.
uemcli -d <array-address> -u <user> /sys/general show -detail
Replace the placeholders with your own array address and user. If the version is 5.4 or earlier, compare it to the fixed release in the Dell advisory. Also check which networks can reach the management interface, because the record describes remote access without authentication.
What to do now
- Find every Unity, UnityVSA and Unity XT system and its operating environment version.
- Read Dell advisory DSA-2025-116 and note the fixed release.
- Schedule the update, following Dell upgrade guidance and taking a recent backup first.
- Restrict the management interface to a dedicated admin network.
- Review management logs for unexpected commands or logins.
Why it matters
The weakness is CWE-78 (OS Command Injection). A command injection happens when input is passed to the operating system shell without removing special characters, so the input can add commands of its own. The record notes that an unauthenticated attacker with remote access could potentially reach command execution.
Storage arrays hold data that other systems depend on. Even with a score of 7.3, command execution on one is serious, mainly because attackers who reach a management network can try it. The record does not flag exploitation and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-49601.
Quick check
Which Dell Unity versions are affected?
The record says version 5.4 and prior.
Does the attacker need an account?
The record describes an unauthenticated attacker with remote access.
Sources
Last reviewed: 19 October 2026.
