OS Command Injection in Dell Unity svc_nas Utility

Successful exploitation allows arbitrary OS command execution as root on the underlying appliance. Because the vulnerability enables escape from a restricted shell, it can fully compromise the affected storage system’s integrity and availability, and may permit administrative takeover, configuration manipulation, service disruption, and access to sensitive data handled by the platform.

If immediate patching is not possible, restrict access to the affected system to only trusted administrators, minimize or disable access to the svc_nas utility where operationally feasible, tightly control local and management-plane access, and monitor for suspicious use of restricted-shell utilities and unexpected root-level command execution. Because exploitation requires valid credentials, prioritize credential hygiene, MFA where supported, and rapid revocation of unnecessary accounts until the upgrade can be completed.

Upgrade Dell Unity Operating Environment to version 5.5.1 or later. Dell states that versions prior to 5.5.1 are affected and that 5.5.1 or later addresses this vulnerability. Apply the vendor-provided update across affected Dell Unity, Dell EMC Unity All Flash, Dell EMC Unity Hybrid, and relevant UnityVSA/Unity XT deployments running vulnerable Unity OE versions.