Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain with Data Domain Operating System contains an Argument Injection vulnerability. A high privileged attacker with local access could exploit this vulnerability, leading to arbitrary command execution. This may allow privilege escalation to root.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.7 | CVE-2025-36565 |
Exploitation
To exploit this vulnerability, an attacker with local access can manipulate command arguments in a way that the system does not properly neutralize them. This could lead to the execution of arbitrary commands with elevated privileges, potentially compromising the entire system.
Affected Products
- Feature Release versions 7.7.1.0 through 8.1.0.10
- LTS2024 release Versions 7.13.1.0 through 7.13.1.25
- LTS 2023 release versions 7.10.1.0 through 7.10.1.50
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of the Data Domain Operating System. Regularly applying security updates and patches can help protect against potential exploitation.