A flaw in Dell PowerProtect Data Domain operating systems 8.4 through 8.5 allows a high‑privileged attacker to exploit an improper restriction of excessive authentication attempts, enabling the attacker to gain unauthorized access to the control plane. The vulnerability permits repeated authentication attempts without a lockout or rate‑limit, which can be leveraged to brute‑force credentials and elevate access on the system. The weakness is identified as CWE‑307 (Improper Restriction of Excessive Authentication Attempts).

Dell PowerProtect Data Domain with Data Domain Operating System feature releases 8.4 and 8.5 are affected.

The CVSS score of 6.2 indicates a medium severity, the EPSS score is less than 1%, and the vulnerability is not listed in CISA KEV. The attack vector is remote, requiring network access to the DD OS and high privileges to make full use of the authentication bypass. Because the flaw is a lack of lockout or rate limiting, an attacker can repeatedly attempt login credentials, potentially discovering valid credentials and gaining unauthorized control of the device.