← Back

CVE-2025-29987

nvd nist
Published: Apr 3, 2025Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: security_alert@emc.com (Secondary)

Description

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulnerability. An authenticated user from a trusted remote client could exploit this vulnerability to execute arbitrary commands with root privileges.

Affected (5)

Dell
3 products
Data Domain Operating System
Powerprotect Data Domain
Powerprotect Dm5500 Firmware
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Dell
Data Domain Operating System
From 7.10.1.0 to 7.10.1.60
Data Domain Operating System
From 7.13.1.0 to 7.13.1.25
Data Domain Operating System
From 8.3.0.0 to 8.3.0.15
Powerprotect Data Domain
Before 7.10.1.60
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Powerprotect Dm5500 Firmware
From 5.12 to 5.19.0.0
Running on/withPlatform Versions
Dell
Powerprotect Dm5500
All versions

Related CWEs

CWE-1220
Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

References (1)

Source: security_alert@emc.com
Vendor Advisory

Timeline

No history available yet.