EUVD-2026-23398
GHSA-7g82-gmhh-22cx
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain a command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to gain root-level access.
AnalysisAI
Command injection in Dell PowerProtect Data Domain allows high-privileged local attackers to execute arbitrary commands and gain root-level access across Feature Release versions 7.7.1.0-8.5, LTS2025 versions 8.3.1.0-8.3.1.20, and LTS2024 versions 7.13.1.0-7.13.1.50. The vulnerability requires local access and elevated privileges (PR:H), limiting exploitation scope to authenticated administrative users with shell or console access. No public exploit or active exploitation has been identified at the time of analysis.
Technical ContextAI
The vulnerability resides in Dell PowerProtect Data Domain operating system command processing logic, classified as CWE-77 (Improper Neutralization of Special Elements used in a Command). Command injection occurs when user-supplied input is concatenated into system commands without proper sanitization or parameterization, allowing attackers to break out of the intended command context and inject arbitrary shell metacharacters or new commands. PowerProtect Data Domain is a deduplication and backup appliance that runs proprietary DD OS; the affected versions span three release tracks (Feature Release, LTS2025, and LTS2024), indicating the vulnerability likely exists in a shared code path across multiple maintenance branches. The requirement for high-privilege local access (AV:L/PR:H) suggests the vulnerable input vector is exposed through administrative interfaces-such as the DD System Manager CLI, SSH console, or management API-rather than unauthenticated network services.
RemediationAI
Apply the security patch released by Dell via advisory DSA-2026-060 (https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities); specific patched versions are listed in the advisory and should be deployed immediately to all affected DD OS instances. Pending patch deployment, compensating controls include: (1) restrict SSH and DD System Manager console access to trusted administrative networks only using firewall rules or network segmentation (trade-off: may limit legitimate remote administration); (2) enforce strict MFA or certificate-based authentication for all administrative accounts accessing the appliance (trade-off: adds authentication latency but eliminates password-compromise risk); (3) audit and disable unnecessary administrative accounts and disable shared credentials (trade-off: requires credential rotation and user re-provisioning); (4) monitor system logs and command audit trails for suspicious command patterns or privilege escalation attempts, triggering immediate lockdown if detected. None of these controls eliminate the vulnerability itself but significantly raise the attacker's barriers to credential acquisition and exploitation.
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection
d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote at
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today