CVE-2025-30096: OS Command Injection
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the DDSH CLI. A high privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30096?
CVE-2025-30096 has been classified with a critical severity level due to its potential exploitation.
How do I fix CVE-2025-30096?
The recommended fix for CVE-2025-30096 is to update to the latest version of the Dell PowerProtect Data Domain software.
What versions of Dell PowerProtect Data Domain are affected by CVE-2025-30096?
CVE-2025-30096 affects Dell PowerProtect Data Domain versions between 7.7.1.0 and 8.1.0.10, as well as LTS2024 versions 7.13.1.0 to 7.13.1.25 and LTS2023 versions 7.10.1.0 to 7.10.1.50.
What types of vulnerabilities does CVE-2025-30096 address?
CVE-2025-30096 addresses vulnerabilities related to improper neutralization of special elements used in output.
Is there a workaround for CVE-2025-30096 while waiting for updates?
Currently, no effective workaround is provided for CVE-2025-30096; it is essential to apply the necessary updates to mitigate the risk.