Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain with Data Domain Operating System contains an incorrect implementation of an authentication algorithm vulnerability in the RestAPI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access. This issue affects multiple feature release versions and could have serious implications for data security.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2025-43727 |
Exploitation
To exploit this vulnerability, an attacker would need remote access to the affected system. By sending specially crafted requests to the RestAPI, the attacker could bypass authentication mechanisms, gaining unauthorized access to sensitive data and system functionalities. This could lead to further exploitation or data breaches if not mitigated.
Affected Products
- Feature Release versions 7.7.1.0 through 8.1.0.10
- LTS2024 release Versions 7.13.1.0 through 7.13.1.25
- LTS 2023 release versions 7.10.1.0 through 7.10.1.50
Mitigation
To mitigate this vulnerability, users should apply the latest security updates provided by Dell for the affected versions of PowerProtect Data Domain. It is also recommended to review access controls and monitor for any unauthorized access attempts to the RestAPI.