Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain appliances contain an improper privilege management vulnerability in IDRAC. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges to access unauthorized delete operations in IDRAC. This could result in significant security risks for affected systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.3 | CVE-2026-35154 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the affected Dell PowerProtect Data Domain appliance. By leveraging high privileges, the attacker can manipulate the IDRAC interface to perform unauthorized delete operations, potentially compromising the integrity and availability of the system.
Affected Products
- PowerProtect Data Domain versions 7.7.1.0 through 8.7.0.0
- PowerProtect Data Domain LTS2025 release versions 8.3.1.0 through 8.3.1.20
- PowerProtect Data Domain LTS2024 release versions 7.13.1.0 through 7.13.1.60
Mitigation
To mitigate this vulnerability, it is recommended that users update their Dell PowerProtect Data Domain appliances to the latest versions provided by Dell. Additionally, restricting local access to authorized personnel and monitoring IDRAC activities can help reduce the risk of exploitation.