Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain with Data Domain Operating System contains an OS Command Injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to command execution. This issue affects multiple feature release versions and could have significant impacts on system integrity.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6 | CVE-2025-46644 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the affected system and possess high privileges. By injecting specially crafted commands into the operating system, the attacker can execute arbitrary commands, potentially compromising the system’s integrity and availability.
Affected Products
- Feature Release versions 7.7.1.0 through 8.4.0.0
- LTS2025 release version 8.3.1.10
- LTS2024 release versions 7.13.1.0 through 7.13.1.40
- LTS2023 release versions 7.10.1.0 through 7.10.1.70
Mitigation
To mitigate this vulnerability, users should ensure that they are running the latest versions of the Data Domain Operating System. Regularly applying security updates and patches provided by Dell can help protect against potential exploitation of this vulnerability.