Product:
PowerProtect Data Manager
Summary
Dell PowerProtect Data Manager versions 19.19 and 19.20 for Hyper-V contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges. This could allow unauthorized access to sensitive data or system controls.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7 | CVE-2025-43887 |
Exploitation
To exploit this vulnerability, an attacker with local access would need to leverage the incorrect default permissions to gain elevated privileges. This could involve executing specific commands or accessing restricted areas of the system that should not be available to low privileged users.
Affected Products
- PowerProtect Data Manager 19.19 – Affected by incorrect default permissions allowing potential privilege escalation.
- PowerProtect Data Manager 19.20 – Similar vulnerability as 19.19, allowing low privileged attackers to gain elevated access.
Mitigation
To mitigate this vulnerability, users should ensure that they apply the latest security updates provided by Dell. It is also recommended to review and adjust permissions settings to limit access to sensitive areas of the system, thereby reducing the risk of exploitation.