Dell PowerProtect Data Domain OS Command Injection Vulnerability Allowing Arbitrary Command Execution as Root

A command injection vulnerability has been identified in Dell PowerProtect Data Domain across several versions, including 7.7.1.0 through 8.6, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60. This vulnerability allows high-privileged attackers with remote access to execute arbitrary commands as the root user. The issue arises from improper input validation, enabling exploitation under specific conditions.

Impact

Exploitation of this vulnerability could lead to unauthorized root-level access on the affected system, allowing the attacker to execute arbitrary commands with full administrative privileges.

Remediation

Users can upgrade to Dell PowerProtect Data Domain versions 8.6.1.10, 8.7.0.0 or later, or for those on the LTS2025 release, version 8.3.1.30 or later. Instructions for upgrading the Data Domain Operating System are available on the Dell Support website.