Dell PowerProtect Data Domain OS Command Injection Vulnerability Allowing Arbitrary Command Execution as Root

A vulnerability allowing OS command injection has been identified in Dell PowerProtect Data Domain. This issue is present in versions 7.7.1.0 prior to 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60. The vulnerability arises from improper neutralization of special elements used in OS commands, enabling a high privileged attacker with local access to execute arbitrary commands with root privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized arbitrary command execution with root privileges on the affected system.

Remediation

Users can upgrade to Dell PowerProtect Data Domain OS versions 8.6.1.10, 8.7.0.0 or later, or for LTS2025 versions 8.3.1.30 or later. Instructions for upgrading the Data Domain Operating System are available on the Dell Support website.