Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain with Data Domain Operating System contains an OS Command Injection vulnerability. A high privileged attacker with local access could exploit this vulnerability, leading to arbitrary command execution. This may allow privilege escalation to root.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.7 | CVE-2025-36567 |
Exploitation
To exploit this vulnerability, an attacker with local access can craft specific commands that are improperly neutralized by the system. By executing these commands, the attacker can gain unauthorized access and execute arbitrary commands on the system, potentially escalating privileges to root.
Affected Products
- Feature Release versions 7.7.1.0 through 8.1.0.10
- LTS2024 release Versions 7.13.1.0 through 7.13.1.25
- LTS 2023 release versions 7.10.1.0 through 7.10.1.50
Mitigation
To mitigate this vulnerability, it is recommended to update the affected products to the latest versions provided by Dell. Regularly applying security updates and patches can help protect against potential exploitation of this vulnerability.