EUVD-2026-23884
GHSA-wr75-mj46-c335
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionCVE.org
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper input validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
AnalysisAI
Root-level command injection in Dell PowerProtect Data Domain versions 7.7.1.0-8.6, 8.3.1.0-8.3.1.20 (LTS2025), and 7.13.1.0-7.13.1.60 (LTS2024) allows high-privileged remote attackers to execute arbitrary commands as root through improper input validation. Vendor patch available via DSA-2026-060. EPSS and KEV data not provided; CVSS 7.2 reflects high impact but requires existing high-level authentication, limiting real-world exploitation to scenarios where admin credentials are already compromised or insider threats exist.
Technical ContextAI
Dell PowerProtect Data Domain is an enterprise backup and deduplication appliance running a specialized DD OS. This vulnerability stems from improper input validation (CWE-20) where user-supplied data from authenticated remote sessions is passed to system commands without adequate sanitization or escaping. Affected CPE: cpe:2.3:a:dell:powerprotect_data_domain across three release branches: mainline (7.7.1.0-8.6), LTS2025 (8.3.1.0-8.3.1.20), and LTS2024 (7.13.1.0-7.13.1.60). The flaw enables command injection at the operating system level, granting root privileges despite the attacker's authentication being at a lower administrative level. This class of vulnerability typically occurs in web-based management interfaces or API endpoints where shell commands are constructed using string concatenation rather than parameterized execution.
RemediationAI
Apply vendor-released patches from Dell Security Advisory DSA-2026-060 immediately. Upgrade mainline deployments to DD OS 8.6.1.10 or later (8.7.0.0 recommended). For LTS2025 deployments, upgrade to DD OS 8.3.1.30 or apply hotfix 2.7.9 with DD OS 8.3.1.30. For LTS2024 deployments, upgrade to DD OS 7.13.1.70 or later. Download patches from https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities. If immediate patching is not feasible, implement compensating controls: restrict remote administrative access to Data Domain systems via network ACLs or firewall rules limiting source IPs to dedicated jump hosts with MFA enforcement, disable or restrict unnecessary administrative API endpoints if product permits, enforce principle of least privilege for all Data Domain admin accounts to minimize high-privilege credential exposure, and deploy enhanced session monitoring with alerting on unusual command execution patterns through syslog forwarding. Note that network restrictions may impair remote management workflows requiring VPN or bastion host access, and session monitoring requires SIEM integration capacity. These mitigations reduce attack surface but do not eliminate the underlying input validation flaw.
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection
d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote at
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today