Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain with Data Domain Operating System contains an OS Command Injection vulnerability. A high privileged attacker with local access could exploit this vulnerability, leading to arbitrary command execution. This may allow privilege escalation to root.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.7 | CVE-2025-43890 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the affected system. By injecting specially crafted commands into the operating system, the attacker can execute arbitrary commands with high privileges, potentially gaining root access and compromising the system’s integrity.
Affected Products
- Feature Release versions 7.7.1.0 through 8.3.0.15
- LTS2025 release version 8.3.1.0
- LTS2024 release versions 7.13.1.0 through 7.13.1.30
- LTS2023 release versions 7.10.1.0 through 7.10.1.60
Mitigation
To mitigate this vulnerability, users should apply the latest security updates provided by Dell for the affected versions of PowerProtect Data Domain. Regularly updating the system and monitoring for unauthorized access can also help reduce the risk of exploitation.