Dell PowerProtect Data Domain appliances running DD OS Feature Release 8.0 through 8.5 and LTS2025 release 8.3.1.0 through 8.3.1.10 are susceptible to a log injection flaw that can cause sensitive information, such as credentials, to be written to log files. An attacker with low privileges and remote access can exploit this flaw, potentially leaking credentials that the attacker could use to impersonate users or elevate privileges if subsequently authorized by a higher‑privileged user. This vulnerability qualifies as a confidentiality compromise and may enable credential theft.

The affected products are Dell PowerProtect Data Domain appliances using the Data Domain Operating System versions listed above. Only systems that have the retention lock feature enabled are vulnerable; products without this feature or running unsupported DD OS versions are not impacted.

The CVSS score of 7.6 indicates a high severity of the flaw. The EPSS score is not available, so the likelihood of exploitation is uncertain, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote access to a low‑privileged account and the presence of an enabled retention lock, conditions that may limit opportunistic attacks but still present a serious risk in environments where these features are common. Attackers could proceed by interacting with the appliance over the network and triggering the log recording of sensitive data.