Use of Risky Cryptographic Algorithm in Dell PowerProtect Data Domain
CVE-2025-43909

3.7LOW

Key Information:

Vendor

Dell
Status
Powerprotect Data Domain With Data Domain Operating System (dd Os) Of Feature Release
Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts2025
Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts2024
Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts2023
Vendor
CVE Published:
7 October 2025

What is CVE-2025-43909?

The Dell PowerProtect Data Domain, running specified versions of its Data Domain Operating System, has a vulnerability stemming from the use of a broken cryptographic algorithm within the DD Boost feature. This allows an unauthenticated attacker with remote access to exploit the system, potentially exposing sensitive information to unauthorized parties.

Affected Version(s)

PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023 7.10.1.0 < 7.10.1.70

PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024 7.13.1.0 < 7.13.1.40

PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025 8.3.1.0 < 8.3.1.10

References

https://www.dell.com/support/kbdoc/en-us/000376224/dsa-20...
vendor-advisory

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.