CVE-2025-30099
📋 TL;DR
This CVE describes an OS command injection vulnerability in Dell PowerProtect Data Domain's DDSH CLI. Attackers with local low-privileged access can execute arbitrary commands with root privileges. Affected systems include Dell PowerProtect Data Domain with DD OS versions 7.7.1.0 through 8.1.0.10 and specific LTS releases.
💻 Affected Systems
- Dell PowerProtect Data Domain
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root-level command execution, allowing data theft, system destruction, or lateral movement.
Likely Case
Privilege escalation from low-privileged user to root, enabling unauthorized administrative actions.
If Mitigated
Limited impact if proper access controls restrict local user access and network segmentation is enforced.
🎯 Exploit Status
Exploitation requires authenticated local access. No public exploit code is known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to versions beyond affected ranges as specified in Dell advisory
Vendor Advisory: https://www.dell.com/support/kbdoc/en-us/000348708/dsa-2025-159-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
Restart Required: Yes
Instructions:
1. Review Dell advisory DSA-2025-159. 2. Download appropriate patches from Dell Support. 3. Apply updates following Dell's documented procedures. 4. Reboot system as required.
🔧 Temporary Workarounds
Restrict Local User Access
allLimit local user accounts to trusted personnel only and enforce least privilege.
Network Segmentation
allIsolate Data Domain systems from general user networks to reduce attack surface.
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized local user access.
- Monitor system logs for unusual command execution or privilege escalation attempts.
🔍 How to Verify
Check if Vulnerable:
Check DD OS version using 'ddos version' command and compare with affected ranges.Check Version:
ddos versionVerify Fix Applied:
Verify version is updated beyond affected ranges and test DDSH CLI functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution via DDSH CLI
- Privilege escalation attempts
- Root-level commands from non-admin users
Network Indicators:
- Local authentication attempts followed by administrative actions
SIEM Query:
Search for 'DDSH' command execution patterns or root privilege changes from low-privileged users.