CVE-2025-36604

published 2025-08-04

CVE-2025-36604: Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability…

Priority P1 94 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV Initial access

Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
dell	unity	>= N/A < 5.5.1	5.5.1
dell	unity_operating_environment	< 5.5.1.0	5.5.1.0

Detection & IOCs extracted from sources · hover to see the quote

url {{BaseURL}}/misc/`curl${IFS}{{interactsh-url}}`/..;/index.html↗

path /misc/..;/index.html↗

command curl${IFS}↗

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Dell UnityVSA AccessTool.pm getCASURL Function Pre-Auth Command Injection Attempt (CVE-2025-36604)"; flow:established,to_server; http.uri; content:"/"; startswith; pcre:"/^.*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; content:"|24 7b|IFS|7d|"; fast_pattern; content:"|3b 2f|"; reference:url,labs.watchtowr.com/its-never-simple-until-it-is-dell-unityvsa-pre-auth-command-injection-cve-2025-36604/; reference:cve,2025-36604; classtype:attempted-admin; sid:2065042; rev:1; metadata:affected_product Dell, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_10_03, cve CVE_2025_36604, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_10_03, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

• → Exploit traffic is plaintext HTTP (not TLS). The injection is carried in the URI path, specifically within the /misc/ endpoint, using backtick command substitution and ${IFS} as a space substitute to evade simple string matching.
• → Nuclei template confirms exploitation is detectable by HTTP 200 response containing the string 'getUrlVars' in the body, 'text/html' content-type, and an out-of-band DNS callback via interactsh. ↗
• → Shodan and FOFA can be used to identify exposed Dell UnityVSA instances by searching for the Unisphere management title. ↗
• → The Snort/ET rule keys on the byte sequence |24 7b|IFS|7d| (i.e., ${IFS}) as a fast_pattern match in the HTTP URI, combined with |3b 2f| (;/) to detect the path traversal/injection combo.
• → The vulnerable function is getCASURL inside AccessTool.pm. The injection point is pre-authentication, requiring no credentials.
• → The PCRE pattern in the Snort rule matches shell metacharacters (;, newline, backtick, pipe, $) in URL-encoded or raw form at the start of the URI path.

• · The Nuclei template uses a single HTTP GET request (max-request: 1) and relies on out-of-band DNS interaction via interactsh for confirmation; environments without OOB callback infrastructure may produce false negatives. ↗
• · The ET Snort rule (sid:2065042) is scoped to plaintext HTTP traffic only; if the Unisphere interface is deployed behind TLS termination, the rule will not fire.

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck 7.3 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78