A command injection flaw in Dell PowerProtect Data Domain allows a highly privileged attacker who already has remote access to execute arbitrary operating system commands. The vulnerability, classified as CWE-77, can give the attacker full root privileges, leading to complete compromise of the appliance’s confidentiality, integrity, and availability.

Dell PowerProtect Data Domain devices running Data Domain Operating System (DD OS) Feature Release versions 7.7.1.0 through 8.5, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.50 are affected. Only these specific versions are listed; newer releases are not known to be impacted.

The CVSS score of 7.2 indicates a high severity flaw. No EPSS score is supplied, and the vulnerability is not listed in the CISA KEV catalog, though the lack of an EPSS value does not guarantee rarity of exploitation. The attack likely requires remote network exposure and upper‑privilege access, making it most relevant to untrusted or compromised users who can reach the appliance. If exploited, the attacker can gain root access, modify or delete data, and potentially pivot to other network assets.