CVE-2025-30097
📋 TL;DR
This CVE describes an OS command injection vulnerability in Dell PowerProtect Data Domain's DDSH CLI. A high-privileged attacker with local access can execute arbitrary commands with root privileges. Affected systems include Dell PowerProtect Data Domain with DD OS versions 7.7.1.0 through 8.1.0.10 and specific LTS releases.
💻 Affected Systems
- Dell PowerProtect Data Domain
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root-level access, allowing data theft, system destruction, or lateral movement to other systems.
Likely Case
Privilege escalation from high-privileged local user to root, enabling unauthorized administrative actions on the Data Domain system.
If Mitigated
Limited impact if proper access controls restrict local high-privileged users and network segmentation is implemented.
🎯 Exploit Status
Requires high-privileged local access and knowledge of command injection techniques. No public exploit available as of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to DD OS versions beyond the affected ranges. Refer to Dell advisory for specific fixed versions.
Vendor Advisory: https://www.dell.com/support/kbdoc/en-us/000348708/dsa-2025-159-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
Restart Required: No
Instructions:
1. Review Dell advisory DSA-2025-159. 2. Download appropriate patch from Dell support. 3. Apply update following Dell's documented procedures for Data Domain systems. 4. Verify update completion.
🔧 Temporary Workarounds
Restrict DDSH CLI Access
allLimit access to DDSH CLI to only necessary administrative users through role-based access controls.
🧯 If You Can't Patch
- Implement strict access controls to limit high-privileged local users to only trusted personnel.
- Monitor and audit DDSH CLI usage for suspicious command patterns or privilege escalation attempts.
🔍 How to Verify
Check if Vulnerable:
Check DD OS version using 'version' command in DDSH CLI and compare against affected version ranges.Check Version:
versionVerify Fix Applied:
After patching, verify DD OS version is outside affected ranges using 'version' command.📡 Detection & Monitoring
Log Indicators:
- Unusual DDSH CLI command patterns, especially with shell metacharacters or unexpected command execution
Network Indicators:
- Not applicable - local exploitation only
SIEM Query:
Search for DDSH CLI logs containing suspicious command injection patterns like ';', '|', '&', '`', or '$()'