OS Command Injection Vulnerability in Dell PowerProtect Data Domain
CVE-2025-43908

6.4MEDIUM

Key Information:

Vendor

Dell
Status
Powerprotect Data Domain With Data Domain Operating System (dd Os) Of Feature Release
Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts2025
Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts2024
Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts2023
Vendor
CVE Published:
7 October 2025

What is CVE-2025-43908?

The Dell PowerProtect Data Domain is affected by a vulnerability that arises from improper neutralization of special elements used in OS commands. This flaw allows attackers with high-level privileges and local access to the system to potentially execute arbitrary commands, which could lead to unauthorized actions and data breaches. Users are advised to apply security updates to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023 7.10.1.0 < 7.10.1.70

PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024 7.13.1.0 < 7.13.1.40

PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025 8.3.1.0 < 8.3.1.10

References

https://www.dell.com/support/kbdoc/en-us/000376224/dsa-20...
vendor-advisory

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.