CVE-2025-36566
📋 TL;DR
This CVE describes an OS command injection vulnerability in Dell PowerProtect Data Domain systems running affected DD OS versions. A high-privileged attacker with local access could execute arbitrary commands, potentially escalating to root privileges. Organizations using vulnerable Dell Data Domain backup appliances are affected.
💻 Affected Systems
- Dell PowerProtect Data Domain
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Root compromise of the Data Domain system allowing complete control over backup infrastructure, data exfiltration, or destruction of backup data.
Likely Case
Privilege escalation from a high-privileged local user to root, enabling persistence, lateral movement, or backup data manipulation.
If Mitigated
Limited impact due to strict access controls, network segmentation, and monitoring preventing local attacker access.
🎯 Exploit Status
Requires local high-privileged access. No public exploit details available. CVSS 6.7 indicates moderate exploit complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply updates per Dell advisory DSA-2025-159
Vendor Advisory: https://www.dell.com/support/kbdoc/en-us/000348708/dsa-2025-159-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
Restart Required: No
Instructions:
1. Review Dell advisory DSA-2025-159. 2. Download appropriate patches from Dell Support. 3. Apply updates following Dell's documented procedures for Data Domain systems. 4. Verify patch application and system functionality.
🔧 Temporary Workarounds
Restrict Local Access
allLimit local administrative access to Data Domain systems to only essential personnel.
Implement Least Privilege
allReview and reduce local user privileges to minimum required for operations.
🧯 If You Can't Patch
- Implement strict access controls limiting who can log into Data Domain systems locally
- Enhance monitoring and logging of local user activities and command execution
🔍 How to Verify
Check if Vulnerable:
Check DD OS version using 'version' command in Data Domain CLI and compare to affected ranges.Check Version:
versionVerify Fix Applied:
Verify version is updated beyond affected ranges and check Dell advisory for specific fixed versions.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns by local users
- Privilege escalation attempts
- Unexpected root-level activities
Network Indicators:
- Not network exploitable - focus on host-based detection
SIEM Query:
Search for Data Domain system logs showing command injection patterns or privilege escalation from local users.