CVE-2025-43943
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Dell Cloud Disaster Recovery, versions prior to 19.20, contains an OS Command Injection vulnerability due to improper neutralization of special elements used in OS commands. A highly privileged attacker with local access could exploit this vulnerability to execute arbitrary commands with root privileges.
Risk Assessment
An attacker with high privileges and local access can execute arbitrary commands as root, leading to full system compromise. This may result in a breach of data confidentiality, integrity, and availability.
Recommendation
Update Dell Cloud Disaster Recovery to version 19.20 or later. It is also recommended to restrict local access to the system to trusted administrators only.
Other vulnerabilities in Dell Cloud Disaster Recovery
See all- CVE-2026-70419Critical
Dell Cloud Disaster Recovery versions 20.2 and prior contain an OS Command Injection vulnerability. A high privileged attacker with remote access could exploit this to execute commands.
- CVE-2026-71172Medium
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
- CVE-2026-71171High
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
Original NVD description (English source)
Dell Cloud Disaster Recovery, version(s) prior to 19.20, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS