RCE in Dell EMC Unity Operating Environment
CVE-2021-43589
Dell EMC Unity, Dell EMC UnityVSA and Dell EMC Unity XT versions prior to 5.1.2.0.5.007 contain an operating system (OS) command injection Vulnerability. A locally authenticated user with high privileges may potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the Unity underlying OS, with the privileges of the vulnerable application. Exploitation may lead to an elevation of privilege.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.004 (36.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.0 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- security_alert@emc.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-43589?
- CVE-2021-43589 is a medium-severity vulnerability in Dell EMC Unity Operating Environment, classified under Command Injection. CVSS score: 6.0/10. Published 2022-01-24.
- How severe is CVE-2021-43589?
- Medium severity. CVSS v3 base score is 6.0 out of 10.