Description
Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an
improper neutralization of argument delimiters in a command ('argument injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution
with root privileges.
Published: 2026-04-17
Score: 6.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Investigation revealed that Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 suffer from an improper neutralization of argument delimiters in a command, constituting an argument injection (CWE‑88) flaw. A local attacker with high privileges can inject arbitrary arguments to command execution and run commands with root privileges, jeopardizing the confidentiality, integrity, and availability of the appliance.

Affected Systems

Dell PowerProtect Data Domain software versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 are vulnerable.

Risk and Exploitability

The CVSS score is 6.7, indicating moderate severity. The EPSS score of < 1% indicates a low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. Exploitation requires local high privileged access, which limits the attack surface. Nevertheless, once local root privileges are achieved, an attacker can execute arbitrary commands, making the impact significant for confidentiality, integrity and availability. Immediate patching is advised.

Generated by OpenCVE AI on August 5, 2026 at 03:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Dell PowerProtect Data Domain security update DSA-2026-060 to all affected versions.
  • Restrict local privileged accounts to reduce the opportunity for exploitation.
  • Monitor system logs for anomalous command executions and review audit trails.

Generated by OpenCVE AI on August 5, 2026 at 03:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
Title Argument Injection Vulnerability in Dell PowerProtect Data Domain Allows Local Privileged Command Execution

Tue, 04 Aug 2026 08:30:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of argument delimiters in a command ('argument injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of argument delimiters in a command ('argument injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

Fri, 08 May 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Dell data Domain Operating System
Dell powerprotect Dp Series Appliance
CPEs cpe:2.3:a:dell:powerprotect_dp_series_appliance:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:data_domain_operating_system:8.7.0.0:*:*:*:*:*:*:*
Vendors & Products Dell data Domain Operating System
Dell powerprotect Dp Series Appliance

Fri, 17 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell powerprotect Data Domain
Vendors & Products Dell
Dell powerprotect Data Domain

Fri, 17 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 17 Apr 2026 11:45:00 +0000

Type Values Removed Values Added
Title Argument Injection Vulnerability in Dell PowerProtect Data Domain Allows Local Privileged Command Execution

Fri, 17 Apr 2026 10:45:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of argument delimiters in a command ('argument injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
Weaknesses CWE-88
References
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Dell Data Domain Operating System Powerprotect Data Domain Powerprotect Dp Series Appliance
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-08-04T08:13:20.864Z

Reserved: 2026-04-01T17:04:27.475Z

Link: CVE-2026-35153

cve-icon Vulnrichment

Updated: 2026-04-17T12:09:59.553Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-17T11:16:10.870

Modified: 2026-06-17T10:40:07.797

Link: CVE-2026-35153

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T03:45:03Z

Weaknesses
  • CWE-88

    Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')