The vulnerability is a stored cross‑site scripting flaw in the Dell PowerProtect Data Domain web interface. An attacker can craft input containing malicious JavaScript that the system saves and later serves to legitimate users. When a victim accesses a page displaying the injected data, the script executes in the user’s browser, allowing the attacker to read sensitive information, hijack session cookies, or make HTTP requests on the user’s behalf, leading to information disclosure, session theft, or client‑side request forgery.

Dell PowerProtect Data Domain firmware versions 7.7.1.0 through 8.7, LTS2026 release 8.6.1.0 through 8.6.1.10, LTS2025 release 8.3.1.0 through 8.3.1.30, and LTS2024 release 7.13.1.0 through 7.13.1.70 are affected. An unauthenticated attacker with remote access to the web interface can exploit the flaw; no special configuration changes or privileged accounts are required, as inferred from the description.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. An attacker can submit a crafted request containing malicious script, which the system stores and serves to legitimate users. Upon viewing the affected page, any user’s browser will run the injected code, leading to the potential impacts described above. Based on the description, it is inferred that no special configuration or privileged accounts are needed to exploit this vulnerability.