A vulnerability in Dell PowerProtect Data Domain allows a low‑privileged attacker with remote access to obtain sensitive information that should remain confidential. The flaw is classified under CWE‑200, indicating information exposure and resulting in a loss of confidentiality. No other impact such as integrity or availability is described in the supplied data.

Dell PowerProtect Data Domain systems running Data Domain Operating System Feature Release versions 7.7.1.0 through 8.5, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.50 are affected.

The CVSS score is 4.3, placing the vulnerability in the low to moderate severity range. An EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote access by a low‑privileged user, implying that an attacker with network reach and some local privileges can exploit the information‑exposure flaw but would need to authenticate or otherwise navigate the system’s access controls. Because the impact is limited to confidentiality and the severity is low, the risk is considered moderate when no additional exploits are known.