An improper privilege management vulnerability exists in Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60. A high‑privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges and access to unauthorized delete operations. The vulnerability is categorized as a CWE‑269 (Access Control).

The vulnerability affects Dell PowerProtect Data Domain appliances running firmware versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of < 1% shows low exploitation probability. The vulnerability is not currently listed in the CISA KEV catalog, suggesting no widespread exploitation yet. A local attacker who has high‑privileged access on the appliance could exploit the flaw by elevating privileges to perform unauthorized delete operations. Because the attack requires local high‑privilege conditions, it is less likely to be leveraged remotely, but within a compromised environment the risk remains significant.