Dell PowerProtect Data Domain OS Command Injection Vulnerability Allowing Arbitrary Command Execution

A command injection vulnerability has been identified in Dell PowerProtect Data Domain systems running Data Domain Operating System (DD OS) versions 7.7.1.0 prior to 8.3.0.15, as well as LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, and LTS2023 release versions 7.10.1.0 through 7.10.1.60. This vulnerability arises from improper neutralization of special elements used in operating system commands, allowing a high-privileged attacker with local access to execute arbitrary commands. Exploitation of this vulnerability could lead to privilege escalation to root.

Impact

Exploitation of this vulnerability allows for arbitrary command execution with root privileges, potentially leading to unauthorized access or modification of system files and settings.

Remediation

Users can upgrade to Dell PowerProtect Data Domain OS versions 8.4.0.0 or later, or for LTS2025, version 8.3.1.10 or later. Instructions for upgrading the Data Domain Operating System are available on the Dell Support website.