CVE-2025-46645 PUBLISHED

Assigner: dell
Reserved: 26.04.2025 Published: 09.01.2026 Updated: 10.01.2026

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release version 8.3.1.10, LTS2024 release versions 7.13.1.0 through 7.13.1.40, LTS 2023 release versions 7.10.1.0 through 7.10.1.70, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CVSS Score: 6.5

Product Status

Vendor Dell
Product PowerProtect Data Domain with Data Domain Operating System (DD OS) Feature Release
Versions Default: unaffected
  • affected from 7.7.1.0 to 8.5.0.0 (excl.)
Vendor Dell
Product PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025
Versions Default: unaffected
  • affected from 8.3.1.0 to 8.3.1.20 (excl.)
Vendor Dell
Product PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS 2024
Versions Default: unaffected
  • affected from 7.13.1.0 to 7.13.1.50 (excl.)
Vendor Dell
Product PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023
Versions Default: unaffected
  • affected from 7.10.1.0 to 7.10.1.80 (excl.)

References

Problem Types

  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE