Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain with Data Domain Operating System contains an OS Command Injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges. This could lead to significant security risks if not addressed promptly.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.7 | CVE-2025-36569 |
Exploitation
To exploit this vulnerability, an attacker with local access would need to craft specific commands that take advantage of the improper neutralization of special elements in the operating system. By executing these commands, the attacker could gain root privileges and perform unauthorized actions on the system.
Affected Products
- Feature Release versions 7.7.1.0 through 8.1.0.10
- LTS2024 release Versions 7.13.1.0 through 7.13.1.25
- LTS 2023 release versions 7.10.1.0 through 7.10.1.50
Mitigation
To mitigate this vulnerability, it is recommended that users update their systems to the latest versions provided by Dell. Regularly applying security updates and patches can help protect against potential exploitation of this vulnerability.