A high‑privileged attacker with remote access can exploit a command injection flaw in Dell PowerProtect Data Domain. The weakness, classified as CWE‑78, allows arbitrary shell commands to be executed with root privileges, potentially compromising the entire appliance and any data it protects. It can be leveraged to gain full control over the system, exfiltrate data, or pivot to other parts of the infrastructure.

Dell PowerProtect Data Domain appliances running versions 7.7.1.0 through 8.6, the LTS2025 release series 8.3.1.0 through 8.3.1.20, and the LTS2024 release series 7.13.1.0 through 7.13.1.60 are affected.

The vulnerability scores a CVSS of 7.2, indicating high severity. EPSS information is currently unavailable, and it is not listed in the CISA KEV catalog. Exploitation requires remote high‑privileged access; the attack vector is inferred from the description, as the official advisory specifies remote exploitation by a privileged attacker.