Dell PowerProtect Data Domain Insufficient Access Control Vulnerability Allowing Root Command Execution

A vulnerability exists in Dell PowerProtect Data Domain systems running versions of the Data Domain Operating System (DD OS) prior to 8.3.0.15. This vulnerability, characterized by insufficient granularity of access control, allows an authenticated user from a trusted remote client to execute arbitrary commands with root privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized command execution with root privileges on the affected system.

Remediation

Users can upgrade to PowerProtect Data Domain DD OS versions 8.3.0.15 or later, 7.13.1.25 or later, or 7.10.1.60 or later, depending on their current version. For detailed upgrade instructions, refer to the Dell PowerProtect Data Domain Upgrade Procedure Knowledge Base article. After upgrading, be aware that certain security scanners may generate false positive detections, for which Dell provides guidance in specific Knowledge Base articles.