Description
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of externally-controlled format string vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and denial of service.
Published: 2026-07-03
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An externally‑controlled format string vulnerability (CWE‑134) exists in Dell PowerProtect Data Domain firmware. When a high‑privileged attacker sends crafted data that is processed as a format string, the appliance can disclose arbitrary memory contents and, in some cases, crash a process, resulting in both information leakage and denial of service.

Affected Systems

Dell PowerProtect Data Domain appliances running firmware versions 7.7.1.0 through 8.7, LTS2026 releases 8.6.1.0 through 8.6.1.10, LTS2025 releases 8.3.1.0 through 8.3.1.30, and LTS2024 releases 7.13.1.0 through 7.13.1.70 are vulnerable.

Risk and Exploitability

The CVSS base score of 5.5 indicates moderate severity, while the EPSS score of less than 1 % reflects a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a high‑privileged remote attacker, likely through administrative interfaces that accept user‑supplied data. The attack vector is inferred to be remote administration access rather than local or anonymous access.

Generated by OpenCVE AI on August 1, 2026 at 20:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Dell DSA‑2026‑278 security update for PowerProtect Data Domain to patch the format string flaw.
  • Restrict remote administrative access to the appliance using network segmentation, firewall rules, or VPN limits until the update is installed.
  • Ensure that any user‑sourced input processed by the system is validated and sanitized to prevent format string handling errors.

Generated by OpenCVE AI on August 1, 2026 at 20:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 01 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
Title Remote Format String Vulnerability in Dell PowerProtect Data Domain Firmware

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Title Externally Controlled Format String Vulnerability in Dell PowerProtect Data Domain

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Title Externally Controlled Format String Vulnerability in Dell PowerProtect Data Domain

Tue, 21 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title Format String Vulnerability in Dell PowerProtect Data Domain Allowing Information Disclosure and Denial of Service

Fri, 17 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title Format String Vulnerability in Dell PowerProtect Data Domain Allowing Information Disclosure and Denial of Service

Thu, 16 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title Dell PowerProtect Data Domain format string vulnerability causing information disclosure and denial of service

Tue, 14 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
Title Dell PowerProtect Data Domain format string vulnerability causing information disclosure and denial of service

Mon, 13 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
Title Externally Controlled Format String Vulnerability in Dell PowerProtect Data Domain

Sat, 11 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
Title Externally Controlled Format String Vulnerability in Dell PowerProtect Data Domain

Sat, 11 Jul 2026 05:45:00 +0000

Type Values Removed Values Added
Title Externally Controlled Format String Vulnerability in Dell PowerProtect Data Domain

Fri, 10 Jul 2026 09:15:00 +0000

Type Values Removed Values Added
Title Externally Controlled Format String Vulnerability in Dell PowerProtect Data Domain

Thu, 09 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
Title Externally-Controlled Format String Vulnerability in Dell PowerProtect Data Domain

Thu, 09 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title Externally-Controlled Format String Vulnerability in Dell PowerProtect Data Domain

Wed, 08 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title Externally Controlled Format String Exploitation in Dell PowerProtect Data Domain

Tue, 07 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Title Externally Controlled Format String Exploitation in Dell PowerProtect Data Domain

Mon, 06 Jul 2026 22:15:00 +0000

Type Values Removed Values Added
Title Externally‑controlled Format String Vulnerability in Dell PowerProtect Data Domain

Mon, 06 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 01:30:00 +0000

Type Values Removed Values Added
Title Externally‑controlled Format String Vulnerability in Dell PowerProtect Data Domain

Sun, 05 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title Externally-Controlled Format String in Dell PowerProtect Data Domain

Sun, 05 Jul 2026 09:00:00 +0000

Type Values Removed Values Added
Title Externally-Controlled Format String in Dell PowerProtect Data Domain

Sun, 05 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Title Externally Controlled Format String in Dell PowerProtect Data Domain Enables Information Disclosure and Denial of Service

Sat, 04 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title Externally Controlled Format String in Dell PowerProtect Data Domain Enables Information Disclosure and Denial of Service

Sat, 04 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Title Externally-Controlled Format String Vulnerability Allowing Information Disclosure and Denial of Service in Dell PowerProtect Data Domain

Sat, 04 Jul 2026 01:15:00 +0000

Type Values Removed Values Added
Title Externally-Controlled Format String Vulnerability Allowing Information Disclosure and Denial of Service in Dell PowerProtect Data Domain

Fri, 03 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell powerprotect Data Domain
Vendors & Products Dell
Dell powerprotect Data Domain

Fri, 03 Jul 2026 14:00:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of externally-controlled format string vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and denial of service.
Weaknesses CWE-134
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H'}

Subscriptions

Dell Data Domain Operating System Powerprotect Data Domain
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-07-06T16:29:09.489Z

Reserved: 2026-05-14T17:05:39.859Z

Link: CVE-2026-46465

cve-icon Vulnrichment

Updated: 2026-07-06T16:29:05.944Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-03T14:16:30.473

Modified: 2026-07-08T19:32:19.660

Link: CVE-2026-46465

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T20:45:05Z

Weaknesses
  • CWE-134

    Use of Externally-Controlled Format String