Product:
PowerProtect Data Manager
Summary
Dell PowerProtect Data Manager contains a Path Traversal vulnerability that allows a high privileged attacker with local access to potentially exploit the system. This could lead to unauthorized filesystem access for the attacker. The vulnerability affects specific versions of the product, making it critical for users to be aware of the risks.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.4 | CVE-2025-43886 |
Exploitation
To exploit this vulnerability, an attacker with high privileges and local access can manipulate file paths to traverse the filesystem. By using crafted input that includes path traversal sequences, the attacker can gain access to sensitive files and directories that should be restricted. This exploitation requires no user interaction and can be executed with minimal complexity.
Affected Products
- PowerProtect Data Manager 19.19: Affected by a Path Traversal vulnerability allowing filesystem access.
- PowerProtect Data Manager 19.20: Similar vulnerability present, posing the same risks as version 19.19.
Mitigation
To mitigate this vulnerability, users should apply the latest security updates provided by Dell for PowerProtect Data Manager. It is essential to restrict local access to the system and monitor for any unauthorized access attempts. Regularly reviewing security configurations and implementing best practices can also help reduce the risk of exploitation.