Data Domain OS CVE-2025-36566

Exploitation requires the attacker to already possess a high-privileged administrative account with local access to the Dell PowerProtect Data Domain appliance running an affected DD OS release (Feature Release 7.7.1.0-8.1.0.10, LTS2024 7.13.1.0-7.13.1.25, or LTS2023 7.10.1.0-7.10.1.50); from that position, crafted OS command input is passed to an affected command-handling function without neutralization, yielding root. The key limiting factors are: no network vector (AV:L - hands-on or authenticated local/shell access to the appliance is mandatory), and a high pre-existing privilege requirement (PR:H), which confines realistic exploitation to malicious insiders or attackers who have already compromised a privileged DD OS administrator account. No user interaction by a victim is required.

This is a genuinely moderate-priority issue rather than an urgent one, and the available signals are consistent with that reading. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7) establishes that exploitation requires local access AND already-high privileges on the appliance, so the attacker must first have a privileged foothold before this bug yields anything. The real value of the flaw is captured in the description: it enables privilege escalation to root, i.e. an authorized high-privileged operator breaking out to full OS control. The EPSS score of 0.60% (47th percentile) is low-to-moderate and aligns with the high barrier to entry - there is no KEV listing and no public exploit identified at time of analysis, so there is no evidence of active or imminent widespread exploitation. No signals conflict here: low EPSS, no KEV, no POC, and a local/high-privilege CVSS vector all point the same direction. The SSVC framing would be exploitation=none, automatable=no (local, privileged precondition), technical impact=total (root). Net: treat as a defense-in-depth / insider-and-post-compromise concern on backup infrastructure, patch on a normal maintenance cadence, and prioritize it higher only where Data Domain appliance admin access is broadly delegated or where the appliance is a high-value backup target in your environment.

An attacker who already holds a high-privileged administrative account on a Dell PowerProtect Data Domain appliance (for example a rogue or compromised DD OS admin) injects crafted OS command metacharacters into an affected command-handling interface. Because input is not properly neutralized, the injected commands execute in the underlying OS context, allowing the attacker to escalate from the appliance admin role to full root control. No public exploit code has been identified, and exploitation requires pre-existing local privileged access, limiting it to post-compromise or insider scenarios.