PowerProtect Data Domain CVE-2025-43727

Requires network access to the Data Domain Operating System RestAPI (management interface) of an affected DD OS build: Feature Release 7.7.1.0 through 8.1.0.10, LTS2024 7.13.1.0 through 7.13.1.25, or LTS2023 7.10.1.0 through 7.10.1.50. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication, no user interaction, and no special non-default configuration are stated as prerequisites - the weakness is in the authentication algorithm implementation itself (CWE-303). The primary limiting factor is exposure: exploitation depends on the attacker being able to reach the appliance's RestAPI, so appliances whose management interface is segmented or not exposed to untrusted networks have materially reduced real-world risk. Impact is limited to unauthorized access/confidentiality; no integrity or availability impact is indicated.

Signals are mostly aligned toward a moderate, not urgent, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, which is consistent with the description's 'unauthenticated attacker with remote access.' However, impact is scoped to confidentiality only (C:H/I:N/A:N), producing a base score of 7.5 (High) rather than Critical - there is no integrity or availability loss and no scope change. EPSS is low at 0.36% (28th percentile), the CVE is NOT on CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was provided in the input. Net: this is a legitimate unauthenticated information-exposure/auth-weakness issue on an enterprise data-protection appliance that should be patched on a normal prioritized cycle, but the absence of KEV, low EPSS, and confidentiality-only impact argue against treating it as an emergency. Note one point to verify: the description phrases the outcome as 'Unauthorized access' (which could imply broader access), while the CVSS vector limits impact strictly to confidentiality (C:H, I:N, A:N) - confirm with Dell DSA-2025-159 whether any integrity impact exists.

An attacker with network reachability to a Dell PowerProtect Data Domain appliance's management RestAPI sends crafted requests that abuse the incorrectly implemented authentication algorithm (CWE-303) to bypass authentication checks. Given AV:N/AC:L/PR:N, this requires no credentials, no user interaction, and low complexity, yielding unauthorized read access to protected data/API resources. No public proof-of-concept is referenced, so exploitation would require independent development.