PowerProtect Data Domain CVE-2025-36567

Exploitation requires the attacker to already have HIGH-privileged LOCAL access to the Dell PowerProtect Data Domain appliance running an affected DD OS version (Feature Release 7.7.1.0 through 8.1.0.10, LTS2024 7.13.1.0 through 7.13.1.25, or LTS2023 7.10.1.0 through 7.10.1.50). There is no network attack vector and no user-interaction path: an unauthenticated or remote-only attacker cannot trigger it. The limiting factors are therefore the prior requirement for privileged local/administrative access to the appliance and a vulnerable DD OS version - this is a privilege-escalation primitive (to root) usable only after an initial foothold, not an initial-access vulnerability.

This is a genuine but lower-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N) is internally consistent with the description: exploitation requires LOCAL access and HIGH existing privileges, so this is a privilege-escalation-to-root flaw rather than a remote entry point. Impact is high across confidentiality, integrity, and availability (C:H/I:H/A:H), which makes sense for arbitrary command execution as root on a backup appliance. The EPSS score is low (0.60%, 47th percentile), consistent with a local-only vulnerability that cannot be mass-exploited over the network. There is no CISA KEV listing and no public exploit identified, so no signal of active exploitation. No SSVC decision data was provided in the input. The signals do not conflict: a moderate base score (6.7), low EPSS, no KEV, and no POC all point to a secondary/chaining vulnerability - valuable to an attacker who has already gained a foothold with high privileges on the appliance, but not an urgent internet-facing emergency. Prioritize patching on appliances where untrusted or lower-trust administrative users exist, after any remotely exploitable issues.

An attacker who already holds a high-privileged local account on a Dell PowerProtect Data Domain appliance injects crafted special characters into an OS command invoked by DD OS, causing arbitrary commands to execute. Because the flaw allows escalation to root, the attacker converts their existing privileged-but-constrained access into full root control of the backup appliance. No public exploit code is known at time of analysis, and remote or unauthenticated exploitation is not possible given the local access and high-privilege requirement.