OS Command Injection Vulnerability in Dell PowerProtect Data Domain
CVE-2025-43890
6.7MEDIUM
Key Information:
- Vendor
Dell
- Status
- Powerprotect Data Domain With Data Domain Operating System (dd Os) Of Feature Release
- Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts2025
- Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts2024
- Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts2023
- Vendor
- CVE Published:
- 7 October 2025
What is CVE-2025-43890?
The Dell PowerProtect Data Domain devices running specific versions of the Data Domain Operating System are susceptible to an OS Command Injection vulnerability. This flaw could allow a high-privileged attacker with local access to execute arbitrary commands, potentially enabling privilege escalation to root level. Users are recommended to review the affected versions and apply necessary security updates to mitigate potential risks.
Affected Version(s)
PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023 7.10.1.0 < 7.10.1.70
PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024 7.13.1.0 < 7.13.1.40
PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025 8.3.1.0 < 8.3.1.10