A vulnerability in Dell PowerProtect Data Domain allows a low‑privileged attacker with remote access to obtain sensitive information that should remain confidential. The flaw is classified under CWE‑200, indicating information exposure, and the updated data includes additional CWE identifiers that are also relevant to this issue, which could further clarify the exact nature of the weakness. No other impact such as integrity or availability is described in the supplied data.

Dell PowerProtect Data Domain systems running Data Domain Operating System Feature Release versions 7.7.1.0 through 8.5, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.50 are affected.

The CVSS score is 4.3, placing the vulnerability in the low to moderate severity range. The EPSS score is 0.0001, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote access by a low‑privileged user, implying that an attacker with network reach and some local privileges could exploit the information‑exposure flaw but would need to authenticate or otherwise navigate the system’s access controls. Because the impact is limited to confidentiality and the severity is low, the risk is considered moderate.