The vulnerability stems from a missing authentication check on a critical function in Dell PowerProtect Data Domain, allowing an attacker to execute arbitrary commands with root privileges. An unauthenticated attacker who can reach the affected service may trigger this flaw; however, the data notes that an authenticated user must perform a specific action, implying the attack path likely requires prior access or privileged credentials.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.6, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 are impacted by the missing authentication flaw that can lead to arbitrary command execution with root privileges.

The CVSS score of 8.8 classifies this as high severity. The EPSS score is not available, so the exact likelihood of exploitation is unknown, but because the flaw permits root‑level command execution, the potential for full system compromise warrants serious concern. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed public exploitation yet. The attack vector is inferred to be remote, requiring network access to the PowerProtect Data Domain appliance, and may necessitate an authenticated user to perform a specific action before the exploit can be successfully leveraged.