The vulnerability arises from improper neutralization of argument delimiters in a command (CWE‑88). In affected Dell PowerProtect Data Domain appliances, a high privileged attacker with local access could exploit this argument injection flaw to inject arbitrary arguments, resulting in arbitrary command execution with root privileges. This would allow the attacker to read, modify, or delete critical configuration data, potentially disrupting the appliance’s availability and compromising stored data.

Dell PowerProtect Data Domain software versions 7.7.1.0 through 8.6.0.0 and 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 are vulnerable.

The CVSS score is 6.7, indicating moderate severity. The EPSS score of < 1% indicates a low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. Exploitation requires local high privileged access, which limits the attack surface. Nevertheless, once local root privileges are achieved, an attacker can execute arbitrary commands, making the impact significant for confidentiality, integrity and availability. Immediate patching is advised.