CVE-2025-36604 is a High severity (CVSS 7.3) OS command injection in Dell Unity 5.5 and prior, including UnityVSA. An unauthenticated attacker with network access could run commands. Dell's advisory DSA-2025-281 covers it, and Unity 5.5.1 was released alongside that advisory.
What's affected
The record lists Dell Unity version 5.5 and prior. The watchTowr write-up tested UnityVSA 5.5.0.0.5.259 and reports it as vulnerable, and says they assume earlier versions are too. The Dell advisory title covers Unity, UnityVSA and Unity XT.
watchTowr's timeline says Dell published its security advisory on 31 July 2025 together with a new product version, 5.5.1. I could not open the Dell page itself because it denied automated access, so confirm the exact fixed build in DSA-2025-281.
How to check if you're exposed
Check the Unity operating environment version in Unisphere or the management interface and compare it with the fixed version in the Dell advisory. If you run UnityVSA, remember that it is a virtual appliance and is often forgotten in patch cycles.
Also check who can reach the management interface. A pre-auth flaw in a storage appliance is far less exposed when management traffic is limited to an admin network.
What to do now
- Inventory Unity, Unity XT and UnityVSA systems and their versions.
- Read DSA-2025-281 and upgrade to the fixed release, 5.5.1 or later as Dell specifies.
- Restrict management interface access to a dedicated administrative network or jump host.
- Review management interface logs for unexpected requests around the period you were exposed.
- Ask the owner of any UnityVSA instance whether it is still in service, and retire unused ones.
Why it matters
The weakness is CWE-78 (OS Command Injection). The watchTowr analysis traces it to a Perl module where a value from a request ends up inside a command string that is run through the shell. If any input is not escaped, an attacker can add their own commands. The fix that Dell shipped is described there as wrapping values in quotes, which is a fragile defence on its own.
WatchTowr also notes that Dell's release notes for that update listed fourteen command injection issues in Unity. A cluster like that suggests the same coding pattern appeared in many places, so a patch is worth taking even if you think your appliance is not exposed.
The record does not mark this CVE as exploited, and I did not find a claim of exploitation in the sources. Public technical detail does exist, so expect scanning to follow.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
The watchTowr timeline says Dell released 5.5.1 with its advisory. Confirm the build in Dell DSA-2025-281.
Does it need a login?
No. The record describes an unauthenticated attacker with network access.
Sources
- watchTowr Labs analysis of CVE-2025-36604
- Dell advisory DSA-2025-281 (could not be loaded here, check directly)
Last reviewed: 18 October 2026.
