An OS command injection flaw exists in Dell PowerProtect Data Domain’s Data Domain Operating System (DD OS). The weakness, designated CWE‑78, allows a high‑privileged attacker who has remote access to execute arbitrary operating system commands, which can lead to full compromise of the affected appliance.

The vulnerability affects Dell PowerProtect Data Domain appliances running DD OS Feature Release versions 7.7.1.0 through 8.5, LTS2025 release versions 8.3.1.0 through 8.3.1.10, and LTS2024 release versions 7.13.1.0 through 7.13.1.40. These cover a broad range of deployment sizes in enterprise backup environments.

The CVSS score of 7.2 indicates a high severity, while the EPSS score of 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits yet. The likely attack vector is inferred to be through remote management interfaces, where a privileged attacker could inject and execute shell commands.