Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain with Data Domain Operating System contains an OS Command Injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges. This could lead to significant security risks if not addressed promptly.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.4 | CVE-2025-43908 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the affected system and possess high privileges. By leveraging the improper neutralization of special elements in OS commands, the attacker can craft specific inputs that allow them to execute arbitrary commands with root privileges, potentially compromising the entire system.
Affected Products
- Feature Release versions 7.7.1.0 through 8.3.0.15
- LTS2025 release version 8.3.1.0
- LTS2024 release versions 7.13.1.0 through 7.13.1.30
- LTS2023 release versions 7.10.1.0 through 7.10.1.60
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Dell. Regularly updating the system and monitoring for unauthorized access can help reduce the risk of exploitation. Additionally, limiting local access to trusted personnel can further enhance security.