OS Command Injection Vulnerability in Dell PowerProtect Data Domain Products
CVE-2025-43906
Key Information:
- Vendor
Dell
- Status
- Powerprotect Data Domain With Data Domain Operating System (dd Os) Of Feature Release
- Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts2025
- Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts2024
- Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts2023
- Vendor
- CVE Published:
- 7 October 2025
What is CVE-2025-43906?
Dell PowerProtect Data Domain products are affected by an OS Command Injection vulnerability that could allow a privileged attacker with local access to execute arbitrary commands within the system. This flaw arises from improper neutralization of special elements used in OS commands, which can lead to privilege escalation, potentially granting the attacker root access. Users are advised to apply the latest security updates and follow best practices to secure their systems against potential exploitation.
Affected Version(s)
PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023 7.10.1.0 < 7.10.1.70
PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024 7.13.1.0 < 7.13.1.40
PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025 8.3.1.0 < 8.3.1.10