Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain with Data Domain Operating System contains an OS command injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution. This poses significant risks to the integrity and confidentiality of the system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.2 | CVE-2026-23774 |
Exploitation
To exploit this vulnerability, an attacker must have high privileges and remote access to the affected system. By injecting malicious commands through the OS command interface, the attacker can execute arbitrary commands, potentially compromising the system’s security and functionality.
Affected Products
- PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.5
- PowerProtect Data Domain LTS2025 release version 8.3.1.0 through 8.3.1.10
- PowerProtect Data Domain LTS2024 release versions 7.13.1.0 through 7.13.1.40
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Dell. Regularly updating the system and monitoring for unauthorized access can help reduce the risk of exploitation. Additionally, implementing strict access controls can limit the potential for high privileged attackers to gain remote access.