Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain with Data Domain Operating System contains an OS Command Injection vulnerability. A high privileged attacker with local access could exploit this vulnerability, leading to arbitrary command execution. This may allow privilege escalation to root.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.7 | CVE-2025-43911 |
Exploitation
To exploit this vulnerability, an attacker with high privileges and local access can craft specific commands that are improperly neutralized by the system. By executing these commands, the attacker can gain control over the system and potentially escalate privileges to root, allowing for further malicious actions.
Affected Products
- Feature Release versions 7.7.1.0 through 8.3.0.15
- LTS2025 release version 8.3.1.0
- LTS2024 release versions 7.13.1.0 through 7.13.1.30
- LTS2023 release versions 7.10.1.0 through 7.10.1.60
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Dell. Regularly updating the system and monitoring for unauthorized access can help reduce the risk of exploitation.