Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain with Data Domain Operating System contains a session fixation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access. This issue affects versions 8.4 through 8.5 of the software.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.2 | CVE-2025-46605 |
Exploitation
To exploit this vulnerability, an attacker must have high privileges and remote access to the affected system. By manipulating session identifiers, the attacker can gain unauthorized access to the system, potentially compromising sensitive data and system integrity.
Affected Products
- PowerProtect Data Domain: Affected versions 8.4 through 8.5 contain the session fixation vulnerability.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of the Data Domain Operating System. Additionally, implementing strict access controls and monitoring for unusual activity can help reduce the risk of exploitation.