CVE-2023-44277
High
Description
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in the CLI. A local low privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker.
SeverityHigh
CVSS7.8
Exploit probability—
ProductDell Powerprotect Data Protection
PublishedDec 14, 2023
First seenDec 14, 2023
Weakness typeCWE-78OS command injection
How to fix
Update
- dell powerprotect_data_protection2.7.6 or later
- dell apex_protection_storage6.2.1.110, 7.10.1.15 or later
- dell powerprotect_data_domain6.2.1.110, 7.12.0.0 or later
- dell powerprotect_data_domain_management_center6.2.1.110, 7.13.0.10, 7.7.5.25, 7.10.1.15 or later
- dell emc_data_domain_os6.2.1.110, 7.12.0.0, 7.7.5.25, 7.10.1.15 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dell powerprotect_data_protection | v < 2.7.6 | 2.7.6 |
| dell apex_protection_storage | v < 6.2.1.110, 7.0 ≤ v < 7.10.1.15 | 6.2.1.110, 7.10.1.15 |
| dell powerprotect_data_domain | v < 6.2.1.110, 7.0 ≤ v < 7.12.0.0 | 6.2.1.110, 7.12.0.0 |
| dell powerprotect_data_domain_management_center | v < 6.2.1.110, 7.0 ≤ v < 7.13.0.10, 7.7 ≤ v < 7.7.5.25, 7.10 ≤ v < 7.10.1.15 | 6.2.1.110, 7.13.0.10, 7.7.5.25, 7.10.1.15 |
| dell emc_data_domain_os | v < 6.2.1.110, 7.0 ≤ v < 7.12.0.0, 7.7 ≤ v < 7.7.5.25, 7.10 ≤ v < 7.10.1.15 | 6.2.1.110, 7.12.0.0, 7.7.5.25, 7.10.1.15 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.