An improper neutralization of special elements used in an OS command, identified as a command injection flaw (CWE‑78), allows a high privileged attacker with local access to execute arbitrary commands with root privileges on Dell PowerProtect Data Domain systems.

Dell PowerProtect Data Domain products are affected in all versions ranging from 7.7.1.0 to 8.7.0.0, as well as the LTS2025 release versions 8.3.1.0 through 8.3.1.20 and the LTS2024 release versions 7.13.1.0 through 7.13.1.60.

The CVSS score of 6.7 indicates a high overall severity for this vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV database, suggesting limited current exploitation evidence. The likely attack vector is local; a user who gains high privileged access can exploit the command injection to run arbitrary commands as root, potentially compromising the entire system and its stored data. Given the root-level impact, the risk is moderate to high, especially in environments where local administrators may be compromised or during maintenance windows.