What is the CVSS score of CVE-2025-46607?

CVE-2025-46607 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2025-46607?

Yes, a patch is available for CVE-2025-46607. Update the affected software to the latest version immediately.

Dell CVE-2025-46607

EUVD-2025-209521 MEDIUM

Improper Authentication (CWE-287)

2026-04-17 dell

GHSA-w6h6-qc6q-q65w

Authentication Bypass Dell

6.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 17, 2026 - 15:07 nvd

Patch available

Apr 17, 2026 - 12:01 EUVD

Analysis Generated

Apr 17, 2026 - 11:55 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 11:45 euvd

EUVD-2025-209521

Analysis Generated

Apr 17, 2026 - 11:45 vuln.today

CVE Published

Apr 17, 2026 - 11:13 nvd

MEDIUM 6.6

DescriptionCVE.org

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper authentication vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

AnalysisAI

Dell PowerProtect Data Domain versions 8.4 through 8.5 contain an improper authentication vulnerability (CWE-287) allowing high-privileged remote attackers to bypass authentication controls and gain unauthorized access to protected systems. The vulnerability requires high privilege level and high attack complexity but enables confidentiality, integrity, and availability impact if successfully exploited. No active exploitation in CISA KEV confirmed at time of analysis.

Technical ContextAI

Dell PowerProtect Data Domain (DD OS) is enterprise backup and recovery software that manages deduplication and data protection across infrastructure. The vulnerability stems from improper implementation of authentication mechanisms (CWE-287) in the feature release track covering versions 8.4 through 8.5. CWE-287 indicates the authentication logic does not properly validate user identity or privilege levels, potentially allowing attackers with existing high-privilege credentials to escalate or bypass additional authentication checks. The remote network vector (AV:N) combined with high privilege requirement (PR:H) suggests this affects privileged users or service accounts with initial system access attempting to bypass secondary authentication layers or access restricted operations.

RemediationAI

Apply vendor-released security update from Dell DSA-2026-060, which provides patched versions addressing the improper authentication vulnerability in PowerProtect Data Domain 8.4-8.5. Consult the advisory for exact patched version numbers and deployment procedures. As an interim compensating control pending patch deployment, restrict remote access to PowerProtect Data Domain administrative interfaces to a network allowlist of trusted management stations and disable unnecessary remote access protocols if not required for operations. Implement strict access controls limiting high-privilege account usage to authorized administrators only, enforce multi-factor authentication for administrative access if supported by the product, and audit authentication logs for suspicious privilege escalation or authentication bypass attempts. Monitor for authentication failures and privilege escalation events in system logs as detection compensating control. Note that these controls add operational friction and should be considered temporary pending patch application, as the underlying vulnerability remains exploitable by determined attackers with legitimate credentials.