CVE-2025-43906: OS Command Injection
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution. Exploitation may allow privilege escalation to root.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43906?
CVE-2025-43906 has been rated as a high severity vulnerability due to its potential impact on system integrity and security.
How do I fix CVE-2025-43906?
To fix CVE-2025-43906, users should update their Dell PowerProtect Data Domain to the latest patched version provided by Dell.
Which versions of Dell PowerProtect Data Domain are affected by CVE-2025-43906?
CVE-2025-43906 affects Dell PowerProtect Data Domain versions from 7.7.1.0 to 8.3.0.15, as well as several LTS versions.
What type of vulnerability is CVE-2025-43906?
CVE-2025-43906 is classified as an Improper Neutralization vulnerability, which could allow unauthorized actions.
Is there a workaround for CVE-2025-43906?
As of now, applying the recommended software update is the primary method to mitigate CVE-2025-43906; no specific workarounds are documented.