CVE-2025-30099: OS Command Injection
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the DDSH CLI. A low privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30099?
CVE-2025-30099 has a critical severity rating due to its potential impact on Dell PowerProtect Data Domain systems.
How do I fix CVE-2025-30099?
To fix CVE-2025-30099, it is recommended to update the affected Dell PowerProtect Data Domain systems to the latest software version provided by Dell.
Which versions of Dell PowerProtect Data Domain are affected by CVE-2025-30099?
CVE-2025-30099 affects Dell PowerProtect Data Domain versions from 7.7.1.0 to 8.1.0.10, as well as versions 7.13.1.0 through 7.13.1.25, and 7.10.1.0 through 7.10.1.50.
What type of vulnerability is CVE-2025-30099?
CVE-2025-30099 is classified as an Improper Neutralization of Special Elements used in an Operating System context, potentially leading to security risks.
What action should I take if my system is affected by CVE-2025-30099?
If your system is affected by CVE-2025-30099, you should immediately apply the relevant security updates to mitigate the vulnerability risks.