EUVD-2025-209524
GHSA-r9x4-2726-c64m
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
Lifecycle Timeline
6DescriptionCVE.org
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper restriction of excessive authentication attempts vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.
AnalysisAI
Dell PowerProtect Data Domain DD OS versions 8.4 through 8.5 fail to enforce rate limiting on authentication attempts, allowing high-privileged remote attackers to conduct brute-force attacks against administrative credentials without account lockout or delays. This authentication bypass vulnerability enables unauthorized access to backup infrastructure systems that manage critical data protection workflows, with CVSS 6.2 reflecting the requirement for already-elevated privileges and high attack complexity.
Technical ContextAI
Dell PowerProtect Data Domain is enterprise deduplication and backup storage software that uses authentication mechanisms to control administrative access. The vulnerability resides in the authentication handling layer (CWE-307: Improper Restriction of Excessive Authentication Attempts), a classic weakness where systems fail to implement brute-force countermeasures such as account lockouts, exponential backoff delays, or CAPTCHA challenges after repeated failed login attempts. The affected versions (DD OS 8.4 and 8.5 Feature Release) lack throttling controls on the authentication attempt processing pipeline. CPE data indicates the vulnerability affects the Dell PowerProtect Data Domain product family across supported installations of these specific OS versions.
RemediationAI
Apply the security update specified in Dell advisory DSA-2026-060 (https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities), which patches the improper authentication attempt restriction. Consult the advisory for exact patched version numbers applicable to your DD OS release stream. Until patching is completed, implement compensating controls: enforce account lockout policies manually via administrative policy if supported by your DD OS configuration, limit network access to the Data Domain management interface to trusted administrative IP ranges using firewall rules (restricting TCP port 3009 or your configured management port to specific subnets), enforce multi-factor authentication for all high-privilege administrative accounts to raise the cost of credential compromise, and implement real-time login attempt monitoring with alerts for repeated failed authentication sequences. Monitor authentication logs (typically in /var/log or equivalent DD OS logging paths) for patterns indicating brute-force activity. These mitigations have the trade-off of potential operational friction-IP restrictions may require VPN or bastion host access for remote administrators, and MFA adds authentication latency-but are essential given the PR:H risk profile.
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection
d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote at
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today