The vulnerability is a session fixation flaw that allows an attacker with high privileged remote access to hijack a user session, enabling unauthorized access to the system. This flaw can let the attacker gain control over the Data Domain operating system and potentially exfiltrate or alter data, compromising confidentiality and integrity.

Dell PowerProtect Data Domain running Data Domain Operating System Feature Release 8.4 through 8.5 is affected. All instances of these versions should be considered vulnerable until patched.

The CVSS score of 6.2 indicates moderate severity, and the EPSS score is not available, suggesting no current data on exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The attack vector appears to be remote and requires high privileged access; no publicly disclosed exploit is known, but the flaw could be used for credential‑less session hijacking under the stated conditions.