An OS command injection flaw is present in Dell PowerProtect Data Domain’s Data Domain Operating System (DD OS). The weakness, identified as CWE‑78, permits a high‑privileged attacker who has remote network access to execute arbitrary operating system commands. Successful exploitation can lead to full compromise of the affected appliance, enabling data exfiltration, service disruption, or further lateral movement within the network.

The vulnerability affects Dell PowerProtect Data Domain appliances running DD OS Feature Release versions 7.7.1.0 through 8.5, LTS2025 release versions 8.3.1.0 through 8.3.1.10, and LTS2024 release versions 7.13.1.0 through 7.13.1.40. These cover a broad range of deployment sizes in enterprise backup environments.

The CVSS score of 7.2 indicates a high severity, while the EPSS score is currently unavailable, so the exploitation probability cannot be quantified at this time. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits yet. The likely attack vector is through remote management interfaces, where a privileged attacker could inject and execute shell commands.