CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-22224: Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_nas utility. An authenticated attacker could...
7.8
CVSS
Description
Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_nas utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges.
Classification
CVE ID: CVE-2024-22224
CVSS Base Severity: HIGH
CVSS Base Score: 7.8
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Problem Types
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Affected Products
Vendor: Dell
Product: Unity
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.17% (probability of being exploited)
EPSS Percentile: 39.32% (scored less or equal to compared to others)
EPSS Date: 2025-06-05 (when was this score calculated)
Stakeholder-Specific Vulnerability Categorization (SSVC)
SSVC Exploitation: none
SSVC Technical Impact: total
SSVC Automatable: false
References
https://nvd.nist.gov/vuln/detail/CVE-2024-22224https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities