OS Command Injection Vulnerability in Dell PowerProtect Data Domain
CVE-2025-30099

7.8HIGH

Key Information:

Vendor

Dell
Status
Powerprotect Data Domain Feature Release
Powerprotect Data Domain Lts2024
Powerprotect Data Domain Lts 2023
Vendor
CVE Published:
4 August 2025

What is CVE-2025-30099?

Dell PowerProtect Data Domain contains a vulnerability in the DDSH CLI that allows a low privileged local attacker to perform Command Injection. This can lead to arbitrary command execution with elevated root privileges. Users are advised to update to the latest secure versions to mitigate this risk.

Affected Version(s)

PowerProtect Data Domain Feature Release 7.7.1.0 <= 8.1.0.10

PowerProtect Data Domain LTS 2023 7.10.1.0 <= 7.10.1.50

PowerProtect Data Domain LTS2024 7.13.1.0 <= 7.13.1.25

References

https://www.dell.com/support/kbdoc/en-us/000348708/dsa-20...
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-30099 : OS Command Injection Vulnerability in Dell PowerProtect Data Domain