Dell Technologies has released a critical security update addressing multiple severe vulnerabilities in its Unity enterprise storage systems that could allow attackers to execute arbitrary commands as root, delete critical system files, and perform other malicious activities without authentication. Dell acknowledged security researchers for responsibly disclosing these vulnerabilities: “prowser” discovered the critical remote command injection flaws, while “zzcentury” and “xiaohei” from Ubisectech Sirius Team identified the local privilege escalation vulnerabilities. Further compounding the risk are multiple local privilege escalation vulnerabilities (CVE-2024-49563, CVE-2024-49564, CVE-2024-49565, CVE-2024-49566, CVE-2025-23383, CVE-2025-24377, CVE-2025-24378, CVE-2025-24379, CVE-2025-24380, CVE-2025-24385, CVE-2025-24386) with CVSS scores of 7.8, allowing low-privileged local users to execute commands with root privileges. Organizations using affected Dell Unity systems should assess their exposure, implement the recommended update, and monitor for signs of exploitation while these critical vulnerabilities remain unpatched. Two additional command injection vulnerabilities (CVE-2024-49601 and CVE-2025-24382) with CVSS 7.3 scores enable unauthenticated, remote attackers to execute commands with lower impact levels.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 31 Mar 2025 14:45:12 +0000