Dell PowerProtect Data Domain OS Command Injection Vulnerability Allowing Arbitrary Command Execution as Root

A command injection vulnerability has been identified in Dell PowerProtect Data Domain versions 8.5 prior to 8.6. A high-privileged attacker with remote access could exploit this vulnerability to execute arbitrary commands with root privileges. The issue arises from improper neutralization of special elements used in operating system commands.

Impact

Exploitation of this vulnerability could lead to unauthorized arbitrary command execution with root privileges on the affected system.

Remediation

Users can upgrade to Dell PowerProtect Data Domain version 8.6.1.10, 8.7.0.0 or later. For detailed upgrade instructions, refer to the Dell PowerProtect Data Domain Upgrade Guide. After upgrading, some security scanners may still report false positive findings. For more information on these false positives, consult the respective Dell False Positive Security Vulnerabilities Knowledge Base articles.