A command injection flaw in Dell PowerProtect Data Domain allows a local attacker with high privileges to issue arbitrary shell commands, potentially escalating to full root access on the device. The vulnerability can be exploited directly from the console or via services that run with elevated rights, enabling the attacker to read, modify, or delete data, and to compromise the integrity and availability of the system.

Dell PowerProtect Data Domain, Data Domain Operating System (DD OS) versions 7.7.1.0 through 8.5, LTS2025 release 8.3.1.0 through 8.3.1.20, and LTS2024 release 7.13.1.0 through 7.13.1.50 are affected.

The CVSS score of 6.7 indicates a moderate severity vulnerability. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog, suggesting limited public exploitation at this time. The likely attack vector is local and requires a high-privileged user; therefore, the risk is significant for systems that could be accessed locally by malicious actors or compromised administrators.