EUVD-2026-23406
GHSA-pc4q-wmj3-q7jg
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
AnalysisAI
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7.0.0 and specific LTS releases (8.3.1.0-8.3.1.20, 7.13.1.0-7.13.1.60) contain an OS command injection vulnerability (CWE-78) that allows high-privileged local attackers to execute arbitrary commands with root privileges. The vulnerability stems from improper neutralization of special elements in OS commands, with a CVSS score of 6.7 reflecting high confidentiality, integrity, and availability impact but constrained by local access and high privilege requirements.
Technical ContextAI
Dell PowerProtect Data Domain is a deduplication and backup storage appliance that manages enterprise backup operations. The vulnerability is rooted in CWE-78 (Improper Neutralization of Special Elements used in an OS Command), a classic command injection flaw where user-controllable input or privileged-user-supplied parameters are passed to OS command execution functions without proper sanitization or escaping. The affected versions span the 7.x and 8.x product lines, indicating the vulnerability exists across multiple major releases. The CPE indicates the vulnerability affects Dell PowerProtect Data Domain across all configurations and platforms where this product runs. The attack surface is limited to local access, meaning the attacker must already have some form of shell or management interface access to the appliance.
RemediationAI
Apply the vendor-released security patch from Dell DSA-2026-060 immediately. Customers should upgrade to patched versions confirmed in the Dell advisory-exact patch versions must be obtained directly from the advisory as they are not specified in the CVE description. Until patching is completed, restrict administrative and high-privilege access to PowerProtect Data Domain appliances to only trusted personnel; implement multi-factor authentication for administrative accounts to reduce the likelihood of credential compromise that could serve as a stepping stone for this exploit. Disable or restrict access to command-line interfaces and management APIs from untrusted networks-if the appliance has remote management capabilities, ensure they are disabled or protected by network segmentation and authentication. Monitor system logs and command audit trails for unusual command execution patterns from high-privileged accounts. Note that these compensating controls do not prevent exploitation by legitimately compromised high-privilege accounts; patching remains the primary remediation.
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection
d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote at
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today