Powerprotect Data Domain Management Center
Monthly
Dell PowerProtect Data Domain Management Center enforces incomplete authorization checks, letting a low-privileged authenticated user perform operations they should not be permitted to carry out, with high integrity impact and limited availability impact and no confidentiality impact (CVSS 7.1). Exploitation requires a pre-existing low-privileged account on the management appliance plus network reachability; an unauthenticated outsider cannot trigger it directly, and the sources do not identify which specific management feature or endpoint lacks the check. No KEV entry, no SSVC emergency flag and no public exploit reference are present - no public exploit identified at time of analysis - but a patch is available from Dell and the release is prioritised as a near-term (this week) patching item rather than an emergency.
SQL injection in Dell PowerProtect Data Domain Management Center allows a remote attacker holding a low-privileged authenticated session to execute arbitrary SQL within the console and, because the assessed scope is changed (S:C), cross the console boundary to gain unauthorized access to the managed Data Domain systems. Affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; the flaw is rated 9.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) and is tracked with an act_now priority. No public exploit code was identified at time of analysis and there is no CISA KEV entry, but vendor fixes are available and the required credentials are the only barrier, so consoles reachable from untrusted networks should be updated promptly.
Missing authorization in Dell PowerProtect Data Domain Management Center (DDMC) allows an authenticated low-privileged, network-positioned user to invoke operations that should be restricted, with high integrity and availability impact on managed Data Domain systems and no confidentiality impact. The affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; the CVSS 3.1 score is 9.6 with scope changed. No public exploit identified at time of analysis, and the vulnerability is prioritized act_now.
OS command injection (CWE-78) in Dell PowerProtect Data Domain Management Center lets a remote attacker who already holds high administrative privileges on the appliance execute arbitrary operating-system commands, with full impact to confidentiality, integrity and availability. Affected branches are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40 and LTS2026 8.6.1.0 through 8.6.1.20; Dell rates it CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). No public exploit code or proof of concept is identified in the available sources and there is no CISA KEV designation, so exploitation requires an attacker to first obtain administrative credentials - meaning stolen admin sessions and insider misuse are the realistic threat paths rather than anonymous internet attack; the specific feature or parameter that carries the injectable input is not described in the available sources.
Dell PowerProtect Data Domain Management Center can be coerced into granting elevated privileges to a remote attacker who already holds a low-privileged authenticated account, because the product performs an authentication decision on a spoofable identity attribute rather than a verified one. Affected releases are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. The impact does not stop at the management appliance: the scope change in the assessed vector (S:C) reflects that a successful escalation can reach other managed Data Domain systems, and vendor-published fixes exist, so the priority decision is act_now; no public exploit code and no CISA KEV entry were identified at time of analysis.
SQL injection in Dell PowerProtect Data Domain Management Center lets a low-privileged authenticated user read data they should not be able to access, with no integrity or availability impact. Affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. No public exploit code or confirmed active exploitation was identified at time of analysis; this is a moderate-severity, lower-priority issue rather than an urgent emergency, with the main prerequisite being that the attacker already holds valid credentials on the management appliance.
An authentication bypass by spoofing (CWE-290) exists in Dell PowerProtect Data Domain Management Center, affecting Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. An attacker who already holds valid low-privilege remote access to the management console (PR:L, AV:N) can exploit the flaw without user interaction to degrade integrity and availability, with a scope change (S:C) but no confidentiality impact; the outcome described is denial of service. No public exploit code or confirmed active exploitation is identified in the available data, and the moderate CVSS score of 6.4 with a 'this_month' priority places it as a limited, non-urgent risk rather than an emergency.
SQL injection in Dell PowerProtect Data Domain Management Center allows a high-privileged, remotely connected attacker to read information the account would not normally expose; there is no indication of data modification or denial of service. Affected releases span Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. The CVSS 3.1 score is 2.7 (PR:H, C:L), Dell has published a fixed-release advisory, and no public exploit has been identified at time of analysis; the dominant risk factor is the requirement for an existing administrative account.
SQL injection in Dell PowerProtect Data Domain Management Center (DDMC) lets an attacker who already holds high-privilege administrative access read limited data from the management appliance, with no integrity or availability impact. Affected builds span Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; the vector is network-reachable with no user interaction, but the PR:H prerequisite restricts realistic exploitation to insiders or someone who has already compromised an admin credential. At CVSS 2.7 this is a low-severity, low-priority item, no public exploit has been identified at the time of analysis, and the vendor has released fixed builds for each branch.
SQL injection in Dell PowerProtect Data Domain Management Center (DDMC) lets a high-privileged remote administrator disclose limited information from the product's database; the CVSS 2.7 score reflects the requirement for an existing administrative account and only a low confidentiality impact. Affected builds span Feature Release 7.7.1.0 through 8.8 and the listed LTS2024, LTS2025, and LTS2026 ranges; no public exploit or active exploitation is identified at time of analysis, so the issue is rated for monitoring.
SQL injection in Dell PowerProtect Data Domain Management Center (DDMC) allows an attacker who already holds administrative-level remote access to read information they should not be able to reach, with no integrity or availability impact. Affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. Scoring is low at CVSS 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) because the PR:H prerequisite sharply limits the attacker pool; there is no CISA KEV listing and no public exploit identified at time of analysis, and the vulnerability is tracked at monitor priority.
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 on DDMC contain an OS command injection vulnerability in an admin operation. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in administrator CLI. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a DOM-based Cross-Site Scripting vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an improper access control vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an SQL Injection vulnerability. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in administrator CLI. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a path traversal vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in the CLI. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect Data Domain Management Center enforces incomplete authorization checks, letting a low-privileged authenticated user perform operations they should not be permitted to carry out, with high integrity impact and limited availability impact and no confidentiality impact (CVSS 7.1). Exploitation requires a pre-existing low-privileged account on the management appliance plus network reachability; an unauthenticated outsider cannot trigger it directly, and the sources do not identify which specific management feature or endpoint lacks the check. No KEV entry, no SSVC emergency flag and no public exploit reference are present - no public exploit identified at time of analysis - but a patch is available from Dell and the release is prioritised as a near-term (this week) patching item rather than an emergency.
SQL injection in Dell PowerProtect Data Domain Management Center allows a remote attacker holding a low-privileged authenticated session to execute arbitrary SQL within the console and, because the assessed scope is changed (S:C), cross the console boundary to gain unauthorized access to the managed Data Domain systems. Affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; the flaw is rated 9.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) and is tracked with an act_now priority. No public exploit code was identified at time of analysis and there is no CISA KEV entry, but vendor fixes are available and the required credentials are the only barrier, so consoles reachable from untrusted networks should be updated promptly.
Missing authorization in Dell PowerProtect Data Domain Management Center (DDMC) allows an authenticated low-privileged, network-positioned user to invoke operations that should be restricted, with high integrity and availability impact on managed Data Domain systems and no confidentiality impact. The affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; the CVSS 3.1 score is 9.6 with scope changed. No public exploit identified at time of analysis, and the vulnerability is prioritized act_now.
OS command injection (CWE-78) in Dell PowerProtect Data Domain Management Center lets a remote attacker who already holds high administrative privileges on the appliance execute arbitrary operating-system commands, with full impact to confidentiality, integrity and availability. Affected branches are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40 and LTS2026 8.6.1.0 through 8.6.1.20; Dell rates it CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). No public exploit code or proof of concept is identified in the available sources and there is no CISA KEV designation, so exploitation requires an attacker to first obtain administrative credentials - meaning stolen admin sessions and insider misuse are the realistic threat paths rather than anonymous internet attack; the specific feature or parameter that carries the injectable input is not described in the available sources.
Dell PowerProtect Data Domain Management Center can be coerced into granting elevated privileges to a remote attacker who already holds a low-privileged authenticated account, because the product performs an authentication decision on a spoofable identity attribute rather than a verified one. Affected releases are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. The impact does not stop at the management appliance: the scope change in the assessed vector (S:C) reflects that a successful escalation can reach other managed Data Domain systems, and vendor-published fixes exist, so the priority decision is act_now; no public exploit code and no CISA KEV entry were identified at time of analysis.
SQL injection in Dell PowerProtect Data Domain Management Center lets a low-privileged authenticated user read data they should not be able to access, with no integrity or availability impact. Affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. No public exploit code or confirmed active exploitation was identified at time of analysis; this is a moderate-severity, lower-priority issue rather than an urgent emergency, with the main prerequisite being that the attacker already holds valid credentials on the management appliance.
An authentication bypass by spoofing (CWE-290) exists in Dell PowerProtect Data Domain Management Center, affecting Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. An attacker who already holds valid low-privilege remote access to the management console (PR:L, AV:N) can exploit the flaw without user interaction to degrade integrity and availability, with a scope change (S:C) but no confidentiality impact; the outcome described is denial of service. No public exploit code or confirmed active exploitation is identified in the available data, and the moderate CVSS score of 6.4 with a 'this_month' priority places it as a limited, non-urgent risk rather than an emergency.
SQL injection in Dell PowerProtect Data Domain Management Center allows a high-privileged, remotely connected attacker to read information the account would not normally expose; there is no indication of data modification or denial of service. Affected releases span Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. The CVSS 3.1 score is 2.7 (PR:H, C:L), Dell has published a fixed-release advisory, and no public exploit has been identified at time of analysis; the dominant risk factor is the requirement for an existing administrative account.
SQL injection in Dell PowerProtect Data Domain Management Center (DDMC) lets an attacker who already holds high-privilege administrative access read limited data from the management appliance, with no integrity or availability impact. Affected builds span Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; the vector is network-reachable with no user interaction, but the PR:H prerequisite restricts realistic exploitation to insiders or someone who has already compromised an admin credential. At CVSS 2.7 this is a low-severity, low-priority item, no public exploit has been identified at the time of analysis, and the vendor has released fixed builds for each branch.
SQL injection in Dell PowerProtect Data Domain Management Center (DDMC) lets a high-privileged remote administrator disclose limited information from the product's database; the CVSS 2.7 score reflects the requirement for an existing administrative account and only a low confidentiality impact. Affected builds span Feature Release 7.7.1.0 through 8.8 and the listed LTS2024, LTS2025, and LTS2026 ranges; no public exploit or active exploitation is identified at time of analysis, so the issue is rated for monitoring.
SQL injection in Dell PowerProtect Data Domain Management Center (DDMC) allows an attacker who already holds administrative-level remote access to read information they should not be able to reach, with no integrity or availability impact. Affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. Scoring is low at CVSS 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) because the PR:H prerequisite sharply limits the attacker pool; there is no CISA KEV listing and no public exploit identified at time of analysis, and the vulnerability is tracked at monitor priority.
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 on DDMC contain an OS command injection vulnerability in an admin operation. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in administrator CLI. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a DOM-based Cross-Site Scripting vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an improper access control vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an SQL Injection vulnerability. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in administrator CLI. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a path traversal vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in the CLI. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.