Dell PowerProtect Data Domain Management Center contains an SQL injection vulnerability due to improper neutralization of special elements in an SQL command. The flaw can be triggered by a high privileged attacker who has remote access to the system. When exploited, the attacker could leak sensitive data from the database, potentially exposing configuration or user information.

Affected versions include Dell PowerProtect Data Domain Management Center Feature Release 7.7.1.0 through 8.8, LTS2024 releases 7.13.1.0 through 7.13.1.80, LTS2025 releases 8.3.1.0 through 8.3.1.40, and LTS2026 releases 8.6.1.0 through 8.6.1.20.

The CVSS score of 2.7 indicates a low severity level, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation visibility. However, because the flaw requires remote access and elevated privileges, the risk is mitigated by restricting access controls and applying the vendor patch. Due to the lack of an EPSS score, exact exploitation probability cannot be quantified, but the low CVSS suggests a modest likelihood in typical environments.