PowerProtect Data Domain CVE-2025-43889

The vulnerable component is the DD OS web management UI, which must be network-reachable to the attacker for exploitation. No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N), so default-configured, exposed management interfaces are at risk. Affected deployments are limited to specific DD OS trains: Feature Release 7.7.1.0 through 8.4, LTS2024 7.13.1.0 through 7.13.1.30, and LTS2023 7.10.1.0 through 7.10.1.60 - appliances outside these version ranges are not affected. The primary limiting factor is network exposure of the management UI: environments that restrict the DD OS UI to isolated management networks substantially reduce real-world reachability. Impact is confined to information exposure (C:H only), with no integrity or availability effect.

This is a genuine but moderate priority. The CVSS 3.1 base of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a cleanly remote, unauthenticated, low-complexity path traversal with high confidentiality impact but no integrity or availability impact - consistent with an information-disclosure-only flaw in the DD OS web UI. The signals are internally consistent: the CVSS vector and the description both point to remote unauthenticated access, so there is no network-vs-local contradiction to flag. The tempering signal is exploitation likelihood: EPSS is only 0.38% (30th percentile), there is no CISA KEV listing and no public POC identified, indicating no evidence of active or imminent widespread exploitation. No SSVC decision was provided in the input, so automatable/technical-impact framing cannot be cited directly; however, the reachable-unauthenticated-UI nature means exploitation would be straightforward if a working primitive emerged. Net: treat as a real, patch-worthy issue for exposed appliances (data confidentiality on a backup platform is sensitive), but not an emergency 'drop everything' item given low EPSS, no KEV, and no public exploit.

An attacker with network reachability to the Dell PowerProtect Data Domain management UI sends a crafted request containing directory-traversal sequences (e.g., ../) to escape the intended web root. Because the flaw is unauthenticated (PR:N) and low-complexity (AC:L), the attacker reads files outside the permitted directory, exposing configuration or other sensitive data from the appliance. No public exploit code has been identified at the time of analysis, so this would currently require the attacker to develop the traversal payload themselves.