← Back

CVE-2025-36565

nvd nist
Published: Oct 7, 2025Modified: Oct 14, 2025

JSON object

Loading...
6.7
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 0.8 / Impact: 5.9
Source: security_alert@emc.com (Secondary)

Description

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution. Exploitation may allow privilege escalation to root.

Affected (3)

Dell
1 product
Data Domain Operating System
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Dell
Data Domain Operating System
From 7.13.1.0 to 7.13.1.30
Data Domain Operating System
From 7.7.1.0 to 7.10.1.60
Data Domain Operating System
From 8.0.0.0 to 8.3.0.10

Related CWEs

CWE-88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

References (1)

Source: security_alert@emc.com
Vendor Advisory

Timeline

No history available yet.