Improper Authentication allows a remote attacker with low privileges to bypass the protective mechanisms enforced by Dell PowerProtect Data Domain appliances. This flaw can grant the attacker unauthorized access to the system, potentially letting them view, modify, or delete protected data, and disrupt normal operations. The issue is classified as CWE-287.

This weakness is present in Dell PowerProtect Data Domain feature releases 7.7.1.0 through 8.8, LTS2024 releases 7.13.1.0-80, LTS2025 releases 8.3.1.0-40, and LTS2026 releases 8.6.1.0-20.

The CVSS score of 8.3 indicates a high severity vulnerability, but the EPSS score is not available, so the likelihood of exploitation remains uncertain. The flaw is not listed in the CISA KEV catalog. It is inferred that a low-privileged remote attacker could exploit the vulnerability over the network, potentially bypassing the appliance’s protection mechanism. With only remote access required, the attack is relatively easy to attempt, though no public exploits have been reported.