Dell PowerProtect Data Domain versions 7.7.1.0 through 8.5, LTS2025 8.3.1.0 through 8.3.1.20, and LTS2024 7.13.1.0 through 7.13.1.50 contain a cross‑site scripting vulnerability that allows a high‑privileged attacker with remote access to inject and execute arbitrary scripts. The flaw results from improper sanitization of user‑controlled input, classified as CWE‑79. Attackers could use the injected script to deface web interfaces or exfiltrate session data, compromising confidentiality and integrity of the management console.

Affected systems include Dell PowerProtect Data Domain devices running the Data Domain Operating System (DD OS) Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.50. All variants of the product that match these version ranges are vulnerable.

The CVSS score of 5.9 indicates a medium impact, while the EPSS score is not available, so the likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attacker must have high‑privilege and remote access to the device, making the attack vector remote but limited to privileged users.