Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain with Data Domain Operating System contains a command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to gain root-level access. This poses significant risks to the integrity and confidentiality of the system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.7 | CVE-2026-23779 |
Exploitation
To exploit this vulnerability, an attacker with local access can execute specially crafted commands that the system does not properly validate. This could allow the attacker to gain elevated privileges and execute arbitrary code, leading to full control over the affected system.
Affected Products
- Feature Release versions 7.7.1.0 through 8.5
- LTS2025 release version 8.3.1.0 through 8.3.1.20
- LTS2024 release versions 7.13.1.0 through 7.13.1.50
Mitigation
To mitigate this vulnerability, users should apply the latest security updates provided by Dell. It is also recommended to limit local access to the affected systems and monitor for any unauthorized access attempts.