Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain with Data Domain Operating System contains a Path Traversal vulnerability. A high privileged attacker with local access could exploit this vulnerability, potentially leading to Denial of service and Unauthorized access. This issue affects multiple feature release versions and LTS releases.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6 | CVE-2025-43934 |
Exploitation
To exploit this vulnerability, an attacker with high privileges and local access can manipulate pathname inputs to gain unauthorized access to restricted directories. By leveraging this flaw, the attacker can execute commands or access sensitive data, resulting in a Denial of service or unauthorized data exposure.
Affected Products
- Feature Release versions 7.7.1.0 through 8.3.0.15
- LTS2025 release version 8.3.1.0
- LTS2024 release versions 7.13.1.0 through 7.13.1.30
- LTS2023 release versions 7.10.1.0 through 7.10.1.60
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Dell. Users should ensure that their systems are running the most recent versions of the Data Domain Operating System and follow best practices for access control to limit local access to high privileged users.