CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
Lifecycle Timeline
1DescriptionNVD
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper restriction of excessive authentication attempts vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.
AnalysisAI
Dell PowerProtect Data Domain DD OS versions 8.4 through 8.5 fail to enforce rate limiting on authentication attempts, allowing high-privileged remote attackers to conduct brute-force attacks against administrative credentials without account lockout or delays. This authentication bypass vulnerability enables unauthorized access to backup infrastructure systems that manage critical data protection workflows, with CVSS 6.2 reflecting the requirement for already-elevated privileges and high attack complexity.
Technical ContextAI
Dell PowerProtect Data Domain is enterprise deduplication and backup storage software that uses authentication mechanisms to control administrative access. The vulnerability resides in the authentication handling layer (CWE-307: Improper Restriction of Excessive Authentication Attempts), a classic weakness where systems fail to implement brute-force countermeasures such as account lockouts, exponential backoff delays, or CAPTCHA challenges after repeated failed login attempts. The affected versions (DD OS 8.4 and 8.5 Feature Release) lack throttling controls on the authentication attempt processing pipeline. CPE data indicates the vulnerability affects the Dell PowerProtect Data Domain product family across supported installations of these specific OS versions.
RemediationAI
Apply the security update specified in Dell advisory DSA-2026-060 (https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities), which patches the improper authentication attempt restriction. Consult the advisory for exact patched version numbers applicable to your DD OS release stream. Until patching is completed, implement compensating controls: enforce account lockout policies manually via administrative policy if supported by your DD OS configuration, limit network access to the Data Domain management interface to trusted administrative IP ranges using firewall rules (restricting TCP port 3009 or your configured management port to specific subnets), enforce multi-factor authentication for all high-privilege administrative accounts to raise the cost of credential compromise, and implement real-time login attempt monitoring with alerts for repeated failed authentication sequences. Monitor authentication logs (typically in /var/log or equivalent DD OS logging paths) for patterns indicating brute-force activity. These mitigations have the trade-off of potential operational friction-IP restrictions may require VPN or bastion host access for remote administrators, and MFA adds authentication latency-but are essential given the PR:H risk profile.
Share
External POC / Exploit Code
Leaving vuln.today