CVE-2025-36606 Overview
CVE-2025-36606 is an OS command injection vulnerability [CWE-78] in Dell Unity storage platforms running Unity Operating Environment version 5.5 and prior. The flaw resides in the svc_nfssupport utility, a service command available within the appliance's restricted shell. An authenticated attacker can inject shell metacharacters into utility arguments, escape the restricted shell, and execute arbitrary operating system commands as root. Dell published fix details in advisory DSA-2025-281.
Critical Impact
Successful exploitation gives an authenticated local user full root control of the Dell Unity, UnityVSA, or Unity XT appliance, breaking the storage administration boundary.
Affected Products
- Dell Unity Operating Environment 5.5 and prior
- Dell UnityVSA (virtual appliance) running affected OE versions
- Dell Unity XT running affected OE versions
Discovery Timeline
- 2025-08-04 - CVE-2025-36606 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-36606
Vulnerability Analysis
Dell Unity appliances expose a service account that lands users in a restricted shell (svc_shell). The shell offers a curated set of svc_* diagnostic utilities intended to constrain what a service technician or administrator can run. svc_nfssupport collects NFS diagnostic data and calls underlying operating system utilities to do so.
The utility fails to properly sanitize or quote user-supplied arguments before passing them to a shell interpreter. This allows an authenticated attacker in the restricted shell to inject shell metacharacters and reach the underlying Linux operating system.
Because svc_nfssupport runs with elevated privileges, injected commands execute as root. The attacker breaks out of the restricted shell sandbox, gaining full control of the storage controller, its configuration, and any data plane it exposes.
Root Cause
The root cause is improper neutralization of special elements used in an OS command [CWE-78]. svc_nfssupport concatenates attacker-controlled input into a command string executed through a shell rather than passing arguments safely to a process with argument arrays. Shell metacharacters such as ;, |, `, and $() are interpreted by the shell instead of being treated as literal data.
Attack Vector
Exploitation requires local access with valid credentials for the Unity service account or an equivalent role that can invoke svc_nfssupport. The attacker authenticates to the restricted shell over SSH or the serial console, invokes svc_nfssupport with a crafted argument containing shell metacharacters, and receives arbitrary command execution as root. No user interaction beyond the attacker's own session is required.
No public proof-of-concept exploit is listed in NVD, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. Refer to Dell's DSA-2025-281 advisory for vendor-supplied technical detail.
Detection Methods for CVE-2025-36606
Indicators of Compromise
- Invocations of svc_nfssupport whose arguments contain shell metacharacters such as ;, &&, |, `, $(, or redirection operators.
- Unexpected root-owned processes spawned as descendants of svc_nfssupport or the service shell.
- New or modified files in /etc, /root, or /home/service following a service-account session.
- Outbound network connections initiated from the Unity storage controller to unfamiliar destinations shortly after service logins.
Detection Strategies
- Audit shell history and appliance service logs for svc_nfssupport calls with unusual arguments or long argument strings.
- Correlate service-account SSH logins with subsequent creation of root-owned processes outside the expected svc_* binary set.
- Alert on service-account sessions that persist longer than typical maintenance windows or occur outside change windows.
Monitoring Recommendations
- Forward Dell Unity audit and SSH authentication logs to a central SIEM and retain them for incident review.
- Monitor privileged account usage on storage infrastructure, treating any interactive root shell as a high-severity event.
- Track configuration drift on Unity appliances, including new local accounts, cron entries, and SSH keys.
How to Mitigate CVE-2025-36606
Immediate Actions Required
- Apply the Dell Unity Operating Environment update referenced in DSA-2025-281 to all Unity, UnityVSA, and Unity XT systems running OE 5.5 or earlier.
- Rotate credentials for the Unity service account and any administrative accounts that could reach the restricted shell.
- Review recent service-account activity for suspicious svc_nfssupport usage or unexpected root-level actions.
Patch Information
Dell has released fixed versions of the Unity Operating Environment addressing this vulnerability. Consult Dell Security Update DSA-2025-281 for the specific fixed OE build numbers, upgrade prerequisites, and download instructions.
Workarounds
- Restrict network access to the Unity management interface and SSH service to a small set of jump hosts used by storage administrators.
- Limit knowledge and use of the service account to authorized personnel, and require multi-party approval for its activation.
- Disable or block interactive service-account sessions between maintenance windows until the patch can be applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
