Dell PowerProtect Data Domain Improper Certificate Validation Vulnerability Allowing Privilege Escalation

A vulnerability exists in Dell PowerProtect Data Domain appliances running Data Domain Operating System (DD OS) versions 7.7.1.0 through 8.5, as well as LTS2025 release version 8.3.1.0 through 8.3.1.20 and LTS2024 release versions 7.13.1.0 through 7.13.1.60. This vulnerability arises from improper validation of certificates during certificate-based login, potentially allowing a low-privileged attacker with remote access to exploit the issue and elevate privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing an attacker to gain elevated rights on the affected system.

Remediation

Users can upgrade to Dell PowerProtect Data Domain DD OS versions 8.6.1.10, 8.7.0.0 or later, or for LTS2024 release versions 7.13.1.70 or later. Instructions for upgrading the Data Domain Operating System are available on the Dell Support website.