Command Injection Vulnerability in Dell PowerProtect Data Domain Products
CVE-2025-43905
4.3MEDIUM
Key Information:
- Vendor
Dell
- Status
- Powerprotect Data Domain With Data Domain Operating System (dd Os) Of Feature Release
- Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts2025
- Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts2024
- Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts2023
- Vendor
- CVE Published:
- 7 October 2025
What is CVE-2025-43905?
A vulnerability exists in Dell PowerProtect Data Domain systems due to an improper neutralization of argument delimiters, allowing a low privileged attacker with remote access to inject commands. If exploited, this flaw can lead to Denial of Service, impacting system availability and data protection capabilities.
Affected Version(s)
PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023 7.10.1.0 < 7.10.1.70
PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024 7.13.1.0 < 7.13.1.40
PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025 8.3.1.0 < 8.3.1.10