Dell PowerProtect Data Domain Argument Injection Vulnerability Leading to Denial-of-Service

A vulnerability allowing improper neutralization of argument delimiters in a command, known as 'argument injection', has been identified in Dell PowerProtect Data Domain systems. This issue is present in the Data Domain Operating System (DD OS) across several release versions, including Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, and LTS 2023 release versions 7.10.1.0 through 7.10.1.60. The vulnerability could be exploited by a low privileged attacker with remote access, potentially leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability can cause a denial-of-service condition, disrupting the availability of the affected system.

Remediation

Users can upgrade to Dell PowerProtect Data Domain OS versions 8.4.0.0 or later, or for specific LTS versions, consult the Dell PowerProtect Data Domain Management Center support page for guidance.