CVE-2025-36566 PUBLISHED

Assigner: dell
Reserved: 15.04.2025 Published: 07.10.2025 Updated: 08.10.2025

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution. Exploitation may allow privilege escalation to root.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 6.7

Product Status

Vendor Dell
Product PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release
Versions Default: unaffected
  • affected from 7.7.1.0 to 8.3.0.10 (excl.)
Vendor Dell
Product PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024
Versions Default: unaffected
  • affected from 7.13.1.0 to 7.13.1.30 (excl.)
Vendor Dell
Product PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023
Versions Default: unaffected
  • affected from 7.10.1.0 to 7.10.1.60 (excl.)

References

Problem Types

  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE