CVE-2025-43908: OS Command Injection
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43908?
The severity of CVE-2025-43908 is classified as a high severity vulnerability.
How do I fix CVE-2025-43908?
To fix CVE-2025-43908, apply the latest security updates provided by Dell for the affected PowerProtect Data Domain versions.
Which versions are affected by CVE-2025-43908?
CVE-2025-43908 affects Dell PowerProtect Data Domain versions from 7.7.1.0 to 8.3.0.15, 8.3.1.0, and versions 7.10.1.0 to 7.10.1.60, and 7.13.1.0 to 7.13.1.30.
What type of vulnerability is CVE-2025-43908?
CVE-2025-43908 is characterized as an Improper Neutralization vulnerability, impacting the security of the device.
Is there a workaround for CVE-2025-43908?
There are currently no official workarounds for CVE-2025-43908; updating the software is recommended.