EUVD-2026-23413
GHSA-6w3g-2v88-h993
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
6DescriptionCVE.org
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain a cross-site Scripting vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
AnalysisAI
Dell PowerProtect Data Domain contains a reflected cross-site scripting (XSS) vulnerability affecting DD OS Feature Release versions 7.7.1.0-8.5, LTS2025 versions 8.3.1.0-8.3.1.20, and LTS2024 versions 7.13.1.0-7.13.1.50. A high-privileged remote attacker can inject malicious scripts into the web interface via crafted requests; if a victim administrator views the malicious link, the script executes in their browser context, potentially leading to credential theft, session hijacking, or unauthorized administrative actions. CVSS 5.9 reflects the requirement for high privileges and user interaction, though the wide version range and network accessibility indicate broad exposure across deployed instances.
Technical ContextAI
This is a reflected cross-site scripting vulnerability (CWE-79) in Dell PowerProtect Data Domain's web management interface. The vulnerability resides in the DD OS (Data Domain Operating System) component, which manages backup and recovery operations in Dell's enterprise data protection appliances. The affected versions span multiple release branches: Feature Release 7.7.1.0 through 8.5, LTS (Long-Term Support) 2025 releases 8.3.1.0 through 8.3.1.20, and LTS 2024 releases 7.13.1.0 through 7.13.1.50. The XSS occurs because user-supplied input in HTTP requests is not properly sanitized before being reflected in HTML responses, allowing attackers to inject arbitrary JavaScript that executes in the context of an authenticated administrator's session. The CVSS vector AV:N/AC:L indicates the vulnerability is accessible over the network with low attack complexity, but PR:H (high privileges required) and UI:R (user interaction required) limit exploitation to high-privileged accounts that must trick victims into visiting a crafted URL.
RemediationAI
Apply the security update provided by Dell in advisory DSA-2026-060 (https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities), which addresses this vulnerability across all affected version branches. Organizations must upgrade Feature Release systems from versions 7.7.1.0-8.5 to the patched release, LTS2025 systems from 8.3.1.0-8.3.1.20 to the patched version, and LTS2024 systems from 7.13.1.0-7.13.1.50 to the patched version. Until patches can be applied, implement compensating controls: restrict remote access to the PowerProtect Data Domain web management interface to trusted IP addresses via firewall rules or network segmentation; enforce strict role-based access control limiting high-privileged accounts to those genuinely requiring administrative access; implement intrusion detection rules to identify XSS payload patterns in HTTP requests to the management interface; and review logs for suspicious administrative access or user-agent anomalies. Additionally, educate administrators to avoid clicking links in untrusted emails or messages that reference the PowerProtect management interface, as user interaction is required for exploitation. Note that applying patches will require planned downtime; coordinate with backup windows to minimize business impact.
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection
d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote at
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today