Dell PowerProtect Data Domain Improper Input Validation Vulnerability Allowing Arbitrary Command Execution

An improper input validation vulnerability has been identified in Dell PowerProtect Data Domain. This vulnerability is present in versions 7.7.1.0 prior to 8.6, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60. A high-privileged attacker with remote access could exploit this vulnerability, leading to arbitrary command execution with root privileges.

Impact

Exploitation of this vulnerability could result in unauthorized arbitrary command execution with root privileges on the affected system.

Remediation

Users can upgrade to Dell PowerProtect Data Domain versions 8.6.1.10, 8.7.0.0 or later. For those on LTS2025, version 8.3.1.30 or later is recommended. LTS2024 users should upgrade to version 7.13.1.70 or later.