The vulnerability is an OS command injection caused by improper neutralization of special elements in operating system commands (CWE-78). Dell PowerProtect Data Domain devices running versions 7.7.1.0 through 8.6.0.0, 8.7.0.0, LTS2025 release series 8.3.1.0 through 8.3.1.20, and LTS2024 release series 7.13.1.0 through 7.13.1.60 are affected. A high-privileged attacker with local access could potentially manipulate input passed directly to the operating system, leading to arbitrary command execution with root privileges, which may compromise the device’s confidentiality, integrity, and availability.

Dell PowerProtect Data Domain devices are affected in all Feature Release versions from 7.7.1.0 up to 8.6.0.0, including version 8.7.0.0, as well as the LTS2025 release series 8.3.1.0 through 8.3.1.20 and the LTS2024 release series 7.13.1.0 through 7.13.1.60. The affected products include the PowerProtect DP Series appliances and the associated Data Domain operating system 8.7.0.0 and prior releases.

The CVSS score of 6.7 indicates a high overall severity for this vulnerability. The EPSS score is less than 1%, and the issue is not listed in CISA’s KEV catalog, suggesting limited publicly known exploitation. The likely attack vector is local; a user who gains high privileged access can exploit the command injection to run arbitrary commands as root, potentially compromising the entire system and its stored data. Given the root-level impact, the risk is moderate to high, especially in environments where local administrators may be compromised or during maintenance windows.