Dell PowerProtect Data Domain OS Command Injection Vulnerability in DDSH CLI

A command injection vulnerability has been identified in the Dell PowerProtect Data Domain operating system (DD OS) within the DDSH command-line interface. This vulnerability affects Feature Release versions 7.7.1.0 through 8.1.0.10, as well as LTS2024 release versions 7.13.1.0 through 7.13.1.25 and LTS2023 release versions 7.10.1.0 through 7.10.1.50. The issue arises from improper neutralization of special elements used in operating system commands, allowing a low-privileged attacker with local access to execute arbitrary commands with root privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of commands with root privileges, potentially allowing for further system compromise or manipulation.

Remediation

Users can upgrade to version 8.3.1.0, 8.4.0.0, or later for DD OS 8.3, or version 7.13.1.30 or later for DD OS 7.13.1. For DD OS 7.10.1, version 7.10.1.60 or later is recommended. Instructions for upgrading the Data Domain Operating System can be found on the Dell Support website.