EUVD-2026-111825
GHSA-6jwx-7mqr-gj44
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with high-privilege account
-
ExploitSend crafted SQL-injection input
-
ExecutionImproper neutralization in SQL command
-
ImpactDatabase returns unauthorized data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated attacker holding high-privilege (administrative) access to the PowerProtect Data Domain Management Center, per CVSS PR:H; it is not exploitable by an unauthenticated or low-privileged user. The vector is remote/network-reachable (AV:N) with no user interaction (UI:N), but the high-privilege prerequisite is the dominant limiting factor, substantially shrinking the realistic attacker population to insiders or those who have already compromised an admin credential. The specific feature, endpoint, or configuration that exposes the SQL-injectable parameter is not described in the available sources. Impact is confined to limited information disclosure (C:L), with no integrity or availability effect. Affected: Feature Release 7.7.1.0-8.8, LTS2024 7.13.1.0-7.13.1.80, LTS2025 8.3.1.0-8.3.1.40, LTS2026 8.6.1.0-8.6.1.20. |
| Impact | This is a genuinely low-priority issue despite being an SQL injection flaw. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, base 2.7) tells a consistent story: although the vector is network-reachable (AV:N) with low complexity (AC:L), exploitation requires high privileges (PR:H) and yields only limited confidentiality impact (C:L) with no integrity or availability impact. The vuln.today Decision label is 'monitor', the lowest urgency tier, which aligns with the low CVSS. No EPSS score was supplied, so exploitation probability cannot be quantified from this data. The CVE is not listed in CISA KEV and no proof-of-concept or exploit reference appears in the input, so there is no public exploit identified at time of analysis. There is no conflict among the signals here - low CVSS, 'monitor' decision, no KEV, and no POC all point the same direction. The main caveat is that the attacker must already hold high-privilege (administrative) access to the management center, which both raises the practical bar and means a successful exploit mostly lets an already-privileged user extract data they may already be positioned to reach. A patch is available from Dell, so remediation is straightforward. |
| Exploit ScenarioDerived | An attacker who already holds high-privilege administrative access to the PowerProtect Data Domain Management Center sends crafted input to a parameter that is improperly neutralized before being used in an SQL command, causing the database to return information the interface would not normally expose. No public exploit code or POC reference is present in the available data, and the trigger (the specific vulnerable feature or parameter) is not described in the sources. The impact is limited to information disclosure (C:L); no data modification or service disruption results. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
SQL injection in Dell PowerProtect Data Domain Management Center (DDMC) lets an attacker who already holds high-privilege administrative access read limited data from the management appliance, with no integrity or availability impact. Affected builds span Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; the vector is network-reachable with no user interaction, but the PR:H prerequisite restricts realistic exploitation to insiders or someone who has already compromised an admin credential. At CVSS 2.7 this is a low-severity, low-priority item, no public exploit has been identified at the time of analysis, and the vendor has released fixed builds for each branch.
RemediationAI
Vendor-released patches are available: upgrade to Feature Release 8.9.0.0 or later, LTS2024 7.13.1.90 or later, LTS2025 8.3.1.50 or later, or LTS2026 8.6.1.30 or later, choosing the branch that matches your supported release train; the exact build numbers and any release-note caveats are documented in Dell advisory DSA-2026-416 (https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities). Because the vulnerable interface is reachable only by holders of high-privilege administrative access, reviewing and trimming the set of accounts with administrative rights to the Management Center reduces the population that could reach the injectable input while upgrades are scheduled, and the low assessed severity plus the monitor priority label mean this can be folded into a normal maintenance cycle rather than an emergency change. No specific vendor workaround or configuration toggle for this issue is described in the available sources, so upgrading remains the complete fix; where immediate patching is not possible, restrict network reachability of the DDMC management interface to trusted administrative networks as a compensating control, accepting that this does not remove the underlying flaw.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-89, improper neutralization of special elements in an SQL command, in the management plane of Dell PowerProtect Data Domain Management Center - the web-based appliance that administers Data Domain protection storage. CPE data (cpe:2.3:a:dell:powerprotect_data_domain_management_center) confirms the affected component is the DDMC application itself rather than the underlying DDOS storage operating system. Because the injected SQL executes in the context of a high-privileged administrative session (CVSS PR:H), the practical ceiling on what an attacker gains is bounded: the assessed impact is confined to confidentiality (C:L) with I:N and A:N, so the injection yields limited information disclosure rather than data modification, authentication bypass, or command execution. The specific feature, endpoint, request parameter, or configuration that exposes the injectable input is not described in the available sources, so the exact trigger path cannot be stated. Note that the AC:L metric reflects the assessed attack complexity as recorded in the CVSS vector and does not by itself establish any particular exploitation technique.
Know when Powerprotect Data Domain Management Center gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Remote-reachable but requires administrative privileges (PR:H); SQL injection yields only limited data read, so C:L with I:N and A:N.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
1DescriptionCVE.org
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
SQL injection in Dell PowerProtect Data Domain Management Center allows a remote attacker holding a low-privileged authe
Missing authorization in Dell PowerProtect Data Domain Management Center (DDMC) allows an authenticated low-privileged,
Dell PowerProtect Data Domain Management Center can be coerced into granting elevated privileges to a remote attacker wh
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an improper access con
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injectio
OS command injection (CWE-78) in Dell PowerProtect Data Domain Management Center lets a remote attacker who already hold
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injectio
Dell PowerProtect Data Domain Management Center enforces incomplete authorization checks, letting a low-privileged authe
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 on DDMC contain an OS command
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injecti
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a path traversal vuln
An authentication bypass by spoofing (CWE-290) exists in Dell PowerProtect Data Domain Management Center, affecting Feat
Exploit-DB