Command Injection Vulnerability in Dell PowerProtect Data Domain
CVE-2025-36565
Key Information:
What is CVE-2025-36565?
Dell PowerProtect Data Domain, utilizing specific versions of its Data Domain Operating System, is susceptible to an argument injection vulnerability. This flaw allows high-privileged attackers with local access to execute arbitrary commands on the system. Exploiting this vulnerability could enable privilege escalation, potentially granting root access to unauthorized users. Organizations using the affected versions should assess their security posture and implement necessary mitigations to protect against potential exploitation.
Affected Version(s)
PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023 7.10.1.0 < 7.10.1.60
PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024 7.13.1.0 < 7.13.1.30
PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release 7.7.1.0 < 8.3.0.10