CVE-2025-30096
📋 TL;DR
This CVE describes an OS command injection vulnerability in Dell PowerProtect Data Domain's DDSH CLI. A high-privileged attacker with local access can execute arbitrary commands with root privileges. Affected systems include Dell PowerProtect Data Domain with DD OS versions 7.7.1.0 through 8.1.0.10, LTS2024 versions 7.13.1.0 through 7.13.1.25, and LTS 2023 versions 7.10.1.0 through 7.10.1.50.
💻 Affected Systems
- Dell PowerProtect Data Domain
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root-level access, allowing data theft, system destruction, or lateral movement to other systems.
Likely Case
Privilege escalation from high-privileged local user to root, enabling unauthorized administrative actions on the Data Domain system.
If Mitigated
Limited impact if proper access controls restrict local access to only trusted administrators and network segmentation is implemented.
🎯 Exploit Status
Requires high-privileged local access and knowledge of command injection techniques. No public exploit available as of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to versions beyond the affected ranges: Feature Release >8.1.0.10, LTS2024 >7.13.1.25, LTS 2023 >7.10.1.50
Vendor Advisory: https://www.dell.com/support/kbdoc/en-us/000348708/dsa-2025-159-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
Restart Required: No
Instructions:
1. Review Dell advisory DSA-2025-159. 2. Download appropriate patch from Dell support portal. 3. Apply patch following Dell's update procedures. 4. Verify version update without requiring system restart.
🔧 Temporary Workarounds
Restrict Local Access
allLimit local access to Data Domain systems to only essential, trusted administrators.
Monitor DDSH CLI Usage
allImplement logging and monitoring for DDSH CLI commands to detect suspicious activity.
🧯 If You Can't Patch
- Implement strict access controls to limit local access to only essential administrators
- Enable comprehensive logging of all DDSH CLI commands and monitor for unusual patterns
🔍 How to Verify
Check if Vulnerable:
Check DD OS version using 'ddos version' command and compare against affected version ranges.Check Version:
ddos versionVerify Fix Applied:
Verify DD OS version is beyond affected ranges: Feature Release >8.1.0.10, LTS2024 >7.13.1.25, LTS 2023 >7.10.1.50📡 Detection & Monitoring
Log Indicators:
- Unusual DDSH CLI command patterns
- Commands with special characters or shell metacharacters in DDSH logs
- Multiple failed command attempts followed by successful execution
Network Indicators:
- Not applicable - local exploitation only
SIEM Query:
source="ddos_logs" AND (command="*;*" OR command="*|*" OR command="*`*" OR command="*$(*" OR command="*&*" OR command="*>" OR command="*<*")