Dell PowerProtect Data Domain OS Command Injection Vulnerability Allowing Arbitrary Command Execution and Privilege Escalation

A command injection vulnerability has been identified in Dell PowerProtect Data Domain systems running Data Domain Operating System (DD OS) versions 7.7.1.0 prior to 8.3.0.15, as well as specific LTS2025, LTS2024, and LTS2023 release versions. This vulnerability arises from improper neutralization of special elements used in operating system commands, allowing a high-privileged attacker with local access to execute arbitrary commands. Exploitation of this vulnerability could lead to unauthorized command execution with root privileges.

Impact

Successful exploitation allows arbitrary command execution with root privileges, potentially leading to unauthorized access or modification of system files and settings.

Remediation

Users can upgrade to Dell PowerProtect Data Domain OS versions 8.4.0.0 or later, or for specific LTS versions, consult the Dell PowerProtect Data Domain Management Center update instructions. For detailed guidance, refer to the Dell PowerProtect Data Domain Knowledge Base articles on upgrading the Data Domain Operating System.