OS Command Injection Vulnerability in Dell PowerProtect Data Domain Products
CVE-2025-36567
Key Information:
What is CVE-2025-36567?
Dell PowerProtect Data Domain, specifically versions 7.7.1.0 through 8.1.0.10, and the LTS2024 and LTS2023 releases, contain a vulnerability that allows for improper neutralization of special elements in an OS command. This flaw enables a highly privileged attacker with local access to execute arbitrary commands, potentially escalating privileges to root. Users are advised to apply security updates promptly to mitigate risks associated with this vulnerability.
Affected Version(s)
PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023 7.10.1.0 < 7.10.1.60
PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024 7.13.1.0 < 7.13.1.30
PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release 7.7.1.0 < 8.3.0.10