PowerProtect Data Domain CVE-2025-36565

Exploitation requires the attacker to already possess high-privileged (administrative) local access to a Dell PowerProtect Data Domain appliance running an affected DD OS build - Feature Release 7.7.1.0 through 8.1.0.10, LTS2024 7.13.1.0 through 7.13.1.25, or LTS2023 7.10.1.0 through 7.10.1.50. The flaw is an argument-injection weakness (CWE-88) in a DD OS command where argument delimiters are not properly neutralized; the limiting factors are the mandatory pre-existing high privilege level (PR:H) and local-only access (AV:L, no network reachability and no user interaction required). There is no indication the vulnerability is reachable by unauthenticated or low-privileged users or across the network, which substantially constrains realistic exploitation to insiders or attackers who have already compromised an admin account.

This is a genuinely moderate-risk issue rather than a top-tier emergency, and the available signals are internally consistent. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N) describes a local vulnerability requiring an attacker to already hold high privileges on the Data Domain appliance, which is the primary limiter on real-world risk - this is a privilege-escalation-to-root flaw, not a remotely-reachable pre-auth RCE. The high impact scores (C:H/I:H/A:H) reflect that a successful exploit yields full root compromise, which is why the base score lands at 6.7 (Medium) despite the steep prerequisites. The EPSS score of 0.21% (10th percentile) is low and aligns with the absence of both CISA KEV listing and any public proof-of-concept, indicating no observed or probable widespread exploitation. No SSVC decision record was provided in the input. The signals do not conflict: a local, high-privilege attack vector naturally produces low exploitation probability. The chief residual risk is as a post-compromise escalation primitive - an attacker who gains a constrained administrative foothold could pivot to root. No key data is contradictory, though no vendor SSVC or affected-version confirmation beyond the Dell advisory and NVD CPE was supplied.

An attacker who has already obtained high-privileged administrative/local access to a Dell PowerProtect Data Domain appliance (e.g., via stolen admin credentials or a prior foothold) invokes an affected DD OS command, injecting crafted argument delimiters that the command improperly neutralizes. This causes the system to execute attacker-controlled arguments, escalating privileges from the admin context to full root control of the backup appliance. No public exploit identified at time of analysis, and the CVSS local vector with low complexity means exploitation is straightforward once the required privileges are held.