Medium severity · published Jan 24, 2022
CVE-2021-43589
Dell EMC Unity, Dell EMC UnityVSA and Dell EMC Unity XT versions prior to 5.1.2.0.5.007 contain an operating system (OS) command injection Vulnerability
6.7
CVSS
0.4%
EPSS
No
On KEV
Description
Dell EMC Unity, Dell EMC UnityVSA and Dell EMC Unity XT versions prior to 5.1.2.0.5.007 contain an operating system (OS) command injection Vulnerability. A locally authenticated user with high privileges may potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the Unity underlying OS, with the privileges of the vulnerable application. Exploitation may lead to an elevation of privilege.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EU
Emc Unity Operating Environment · Dell
before 5.1.2.0.5.007 · source: NVD
EU
Emc Unity XT Operating Environment · Dell
before 5.1.2.0.5.007 · source: NVD
EU
Emc Unityvsa Operating Environment · Dell
before 5.1.2.0.5.007 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-43589
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-43589
Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000194836/dsa-2021-271-dell-emc-unity-dell-emc-unity-vsa-and-dell-emc-unity-xt-security-update-for-multiple-vulnerabilities
More from Emc Unity Operating Environment
9.8
CVE-2021-36287
Dell VNX2 for file version 8.1.21.266 and earlier, contain an unauthenticated remote code execution vulnerability which may lead unauthenticated users to execute commands on the…
9.8
CVE-2021-36294
Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass vulnerability
9.8
CVE-2018-1183
In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual…
9.1
CVE-2021-36288
Dell VNX2 for File version 8.1.21.266 and earlier, contain a path traversal vulnerability which may lead unauthenticated users to read/write restricted files
7.8
CVE-2021-36289
Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain a sensitive information disclosure vulnerability