PowerProtect Data Domain CVE-2025-36569

Exploitation requires the attacker to already hold high-privileged (administrative) local access to the DD OS management/command interface on a Dell PowerProtect Data Domain appliance running an affected release (DD OS Feature Release 7.7.1.0-8.1.0.10, LTS2024 7.13.1.0-7.13.1.25, or LTS2023 7.10.1.0-7.10.1.50); the attacker then injects unneutralized shell metacharacters into an OS command to escalate from the admin context to root. Key LIMITING factors: this is not network-reachable (AV:L), no unauthenticated path exists (PR:H requires prior admin credentials/session), and no user interaction of a victim is needed - so realistic risk is confined to insiders, compromised admin accounts, or chained post-authentication attacks rather than external mass exploitation.

This is a privilege-escalation-class flaw rather than a remotely exploitable one, and the signals are consistent in pointing to moderate, bounded risk. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N, base 6.7 Medium) requires LOCAL access AND already-high privileges, meaning an attacker must first be an authenticated administrative user on the DD OS appliance before this bug yields full root. EPSS reinforces this: at 0.47% (39th percentile) the modeled near-term exploitation probability is low, which aligns with a flaw that is not remotely reachable and depends on pre-existing privileged access. There is no CISA KEV listing (not actively exploited per available data) and no public exploit code identified. No SSVC decision data was provided in the input, so exploitation/automatable/technical-impact cannot be stated from SSVC. The one tension worth noting: technical impact is high (C:H/I:H/A:H, root command execution) even though reachability is low, so this is a 'high-impact-but-hard-to-reach' issue - a meaningful post-compromise or insider/privilege-boundary concern, not a mass-exploitation priority. Treat it as a patch-on-normal-cadence item unless the appliance's admin accounts are shared, exposed, or weakly protected.

An attacker who has already obtained high-privileged (administrative) local access to a Dell PowerProtect Data Domain appliance supplies crafted input to a DD OS command interface that fails to neutralize special shell characters. The injected OS command runs with root privileges, letting the attacker break out of the restricted admin context and fully control the backup appliance. No public proof-of-concept exploit has been identified at time of analysis.