Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain with Data Domain Operating System contains an OS Command Injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution. This affects multiple feature release versions and LTS releases of the operating system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2025-46645 |
Exploitation
To exploit this vulnerability, an attacker must have high privileges and remote access to the affected system. By sending specially crafted commands to the system, the attacker can manipulate the OS command execution process, potentially allowing them to execute arbitrary commands on the server.
Affected Products
- Feature Release versions 7.7.1.0 through 8.4.0.0
- LTS2025 release version 8.3.1.10
- LTS2024 release versions 7.13.1.0 through 7.13.1.40
- LTS2023 release versions 7.10.1.0 through 7.10.1.70
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Dell. Users should ensure that their systems are running the most recent versions of the Data Domain Operating System and follow best practices for securing remote access.