Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain contains an OS command injection vulnerability affecting multiple versions. A high privileged attacker with remote access could exploit this vulnerability, leading to arbitrary command execution as root. This poses significant risks to the integrity and confidentiality of the system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.2 | CVE-2026-24506 |
Exploitation
To exploit this vulnerability, an attacker must have high privileges and remote access to the affected system. By sending specially crafted commands to the system, the attacker can execute arbitrary commands with root privileges, potentially compromising the entire system.
Affected Products
- PowerProtect Data Domain versions 7.7.1.0 through 8.6
- LTS2025 release version 8.3.1.0 through 8.3.1.20
- LTS2024 release versions 7.13.1.0 through 7.13.1.60
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of PowerProtect Data Domain that addresses this issue. Regularly applying security updates and monitoring for unauthorized access can also help reduce the risk of exploitation.