CVE-2025-36567: OS Command Injection
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution. Exploitation may allow privilege escalation to root.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-36567?
CVE-2025-36567 has been classified with a critical severity due to its potential to allow unauthorized access.
How do I fix CVE-2025-36567?
To remediate CVE-2025-36567, upgrade your Dell PowerProtect Data Domain to a version that is not affected by this vulnerability.
Which versions of Dell PowerProtect Data Domain are affected by CVE-2025-36567?
CVE-2025-36567 affects Dell PowerProtect Data Domain versions from 7.7.1.0 to 8.1.0.10, and several versions in the 7.10.x and 7.13.x series.
What type of vulnerability is CVE-2025-36567?
CVE-2025-36567 is categorized as an Improper Neutralization of Special Elements used in an OS Command vulnerability.
Is there a workaround for CVE-2025-36567 until I can update?
There are currently no specific workarounds available for CVE-2025-36567; updating to the fixed version is recommended.