Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain with Data Domain Operating System contains a vulnerability related to the use of a broken or risky cryptographic algorithm in the authentication process. An unauthenticated attacker with remote access could exploit this vulnerability, potentially leading to information disclosure. This affects multiple feature release versions and LTS releases.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.3 | CVE-2025-43891 |
Exploitation
To exploit this vulnerability, an attacker would need remote access to the affected system. By leveraging the weak cryptographic algorithm used in the authentication process, the attacker could gain unauthorized access to sensitive information stored on the system. This could be achieved without requiring any privileges or user interaction, making it a low-complexity attack.
Affected Products
- Feature Release versions 7.7.1.0 through 8.3.0.15
- LTS2025 release version 8.3.1.0
- LTS2024 release versions 7.13.1.0 through 7.13.1.30
- LTS2023 release versions 7.10.1.0 through 7.10.1.60
Mitigation
To mitigate this vulnerability, it is recommended to update the affected systems to the latest versions that address the cryptographic algorithm issues. Regularly applying security updates and patches from the vendor can help protect against potential exploitation. Additionally, monitoring for unauthorized access attempts can further enhance security.