Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an OS command injection vulnerability. A high privileged attacker with local access could exploit this vulnerability, leading to arbitrary command execution with root privileges.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.7 | CVE-2026-35072 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the affected system. By crafting specific OS commands that are improperly handled by the application, the attacker can execute arbitrary commands with root privileges, potentially compromising the entire system.
Affected Products
- PowerProtect Data Domain versions 7.7.1.0 through 8.7.0.0
- LTS2025 release versions 8.3.1.0 through 8.3.1.20
- LTS2024 release versions 7.13.1.0 through 7.13.1.60
Mitigation
To mitigate this vulnerability, users should update their PowerProtect Data Domain systems to the latest versions provided by Dell. Regularly applying security updates and patches can help protect against potential exploitation of this and other vulnerabilities.