OS Command Injection Flaw in Dell PowerProtect Data Domain
CVE-2025-46645
6.5MEDIUM
Key Information:
- Vendor
Dell
- Status
- Powerprotect Data Domain With Data Domain Operating System (dd Os) Feature Release
- Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts2025
- Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts 2024
- Powerprotect Data Domain With Data Domain Operating System (dd Os) Lts2023
- Vendor
- CVE Published:
- 9 January 2026
What is CVE-2025-46645?
Dell PowerProtect Data Domain systems are susceptible to an OS Command Injection vulnerability, where improper handling of special elements in commands can be exploited by high-privileged remote attackers. Such exploitation allows for unauthorized command execution, potentially compromising the integrity and stability of the affected systems.
Affected Version(s)
PowerProtect Data Domain with Data Domain Operating System (DD OS) Feature Release 7.7.1.0 < 8.5.0.0
PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS 2024 7.13.1.0 < 7.13.1.50
PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023 7.10.1.0 < 7.10.1.80
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved