Product:
PowerProtect Data Manager
Summary
Dell PowerProtect Data Manager, Generic Application Agent, versions 19.19 and 19.20, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to code execution. This could allow unauthorized actions to be performed on the affected system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2025-43725 |
Exploitation
To exploit this vulnerability, an attacker with local access can manipulate the default permissions set on the application. By doing so, they can execute arbitrary code with the privileges of the application, potentially leading to unauthorized access and control over the system.
Affected Products
- PowerProtect Data Manager 19.19: Contains an Incorrect Default Permissions vulnerability that can be exploited by low privileged attackers.
- PowerProtect Data Manager 19.20: Similar vulnerability as in version 19.19, allowing for potential code execution by local attackers.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Dell PowerProtect Data Manager that addresses the Incorrect Default Permissions issue. Additionally, review and adjust the permissions settings to ensure that only authorized users have access to sensitive functionalities.