CVE-2023-48668: OS Command Injection
First published: Thu Dec 14 2023(Updated: )
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 on DDMC contain an OS command injection vulnerability in an admin operation. A local high privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the managed system application's underlying OS with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker on a managed system of DDMC.
Credit: security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dell PowerProtect Data Domain Management Center | <6.2.1.110 | |
| Dell PowerProtect Data Domain Management Center | >=7.0<7.13.0.10 | |
| Dell PowerProtect Data Domain Management Center | >=7.7<7.7.5.25 | |
| Dell PowerProtect Data Domain Management Center | >=7.10<7.10.1.15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2023-48668?
CVE-2023-48668 has been classified as a high severity vulnerability due to its potential for exploitation by local high privileged attackers.
How do I fix CVE-2023-48668?
To fix CVE-2023-48668, upgrade to Dell PowerProtect DD versions 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, or 6.2.1.110 or later.
Who is affected by CVE-2023-48668?
CVE-2023-48668 affects Dell PowerProtect Data Domain Management Center versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, and 6.2.1.110.
What could an attacker do if they exploit CVE-2023-48668?
An attacker exploiting CVE-2023-48668 could execute arbitrary OS commands with high privileges on the affected system.
Is there a workaround for CVE-2023-48668?
There are no documented workarounds for CVE-2023-48668, so it is recommended to apply the necessary updates as soon as possible.
- agent/weakness
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/severity
- agent/references
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/dell
- canonical/dell powerprotect data domain management center
- version/dell powerprotect data domain management center/7.0
- version/dell powerprotect data domain management center/7.7
- version/dell powerprotect data domain management center/7.10