Dell PowerProtect Data Domain running Data Domain Operating System Feature Release 8.4 through 8.5 suffers from an improper authentication flaw (CWE‑287). A high‑privileged attacker who can reach the appliance remotely could potentially exploit the weakness, allowing that attacker to gain unauthorized access.

Dell PowerProtect Data Domain appliances that run DD OS Feature Release 8.4 and 8.5 are affected. The flaw exists in the component that processes remote authentication requests.

The CVSS score of 6.6 indicates moderate severity. The EPSS score is reported as < 1 %, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote access and a high‑privileged attacker; once achieved, the attacker gains unauthorized capabilities on the appliance.