OS Command Injection Vulnerability in Dell PowerProtect Data Domain
CVE-2025-43908
6.4MEDIUM
Key Information:
- Vendor
Dell
- Status
- Powerprotect Data Domain With Data Domain Operating System (dd Os) Of Feature Release
- Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts2025
- Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts2024
- Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts2023
- Vendor
- CVE Published:
- 7 October 2025
What is CVE-2025-43908?
The Dell PowerProtect Data Domain is affected by a vulnerability that arises from improper neutralization of special elements used in OS commands. This flaw allows attackers with high-level privileges and local access to the system to potentially execute arbitrary commands, which could lead to unauthorized actions and data breaches. Users are advised to apply security updates to mitigate this risk.
Affected Version(s)
PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023 7.10.1.0 < 7.10.1.70
PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024 7.13.1.0 < 7.13.1.40
PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025 8.3.1.0 < 8.3.1.10