CVE-2025-36604 is a critical OS Command Injection vulnerability affecting Dell Unity versions 5.5 and prior. This flaw allows an unauthenticated, remote attacker to execute arbitrary commands, posing a severe risk to confidentiality, integrity, and availability. With a CVSS score of 9.8, it is easily exploitable over the network with low attack complexity. While not yet in CISA's KEV catalog, public Nuclei templates and a detailed blog post indicate readily available exploit code, and community discussion suggests significant attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.5.1.0CPE matchmatch criteria | cpe:2.3:a:dell:unity_operating_environment:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.