EUVD-2026-23407Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS Command Injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
AnalysisAI
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7.0.0, LTS2025 releases 8.3.1.0-8.3.1.20, and LTS2024 releases 7.13.1.0-7.13.1.60 allow local high-privileged attackers to execute arbitrary OS commands with root privileges via improper neutralization of special elements in command construction (OS command injection). No public exploit code or active exploitation has been identified at the time of analysis, but the vulnerability affects critical backup and disaster recovery infrastructure with direct root access potential.
Technical ContextAI
The vulnerability resides in Dell PowerProtect Data Domain's command processing logic, which fails to properly sanitize or escape special shell metacharacters before passing user-supplied or system-derived input to OS command execution functions. This is a classic OS command injection vulnerability (CWE-78), where an attacker can inject shell metacharacters (such as pipes |, semicolons ;, command substitution $()/``, or redirects >, <) to break out of the intended command context and execute arbitrary commands. The affected versions span multiple release branches (mainstream 7.7.x-8.7.x, LTS2024 7.13.1.x, and LTS2025 8.3.1.x), indicating the root cause may exist in shared code across release maintenance tracks. Dell PowerProtect Data Domain is a deduplication and backup appliance running on hardened Linux-based systems; command injection at the appliance management layer can compromise the entire backup ecosystem.
RemediationAI
Apply the security patch provided in Dell Security Advisory DSA-2026-060 as the primary mitigation. Consult the advisory for exact patched version numbers for each release track (7.7.x, 8.3.1.x LTS2025, 7.13.1.x LTS2024). Until patching is possible, restrict local shell access to PowerProtect Data Domain appliances to trusted administrative personnel only; review and audit SSH keys, service account credentials, and scheduled job definitions (cron, systemd timers) that interact with system command execution. Disable or restrict access to any management interfaces or APIs that allow command-like inputs if feasible, and monitor system logs (auth.log, audit logs) for unauthorized privilege escalation or unexpected command execution patterns. Implement network segmentation to limit access to backup appliance management ports to trusted administrative networks only. Note that these workarounds do not eliminate the vulnerability and increase operational overhead; patching should be prioritized.
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection
d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote at
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today