CVE-2023-48667
High
Description
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in administrator CLI. A remote high privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS to bypass security restriction. Exploitation may lead to a system take over by an attacker.
SeverityHigh
CVSS7.2
Exploit probability—
ProductDell Powerprotect Data Domain
PublishedDec 14, 2023
First seenDec 14, 2023
Weakness typeCWE-78OS command injection
How to fix
Update
- dell powerprotect_data_domain6.2.1.110, 7.12.0.0 or later
- dell apex_protection_storage6.2.1.110, 7.10.1.15 or later
- dell powerprotect_data_domain_management_center6.2.1.110, 7.13.0.10, 7.7.5.25, 7.10.1.15 or later
- dell emc_data_domain_os6.2.1.110, 7.12.0.0, 7.7.5.25, 7.10.1.15 or later
- dell powerprotect_data_protection2.7.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dell powerprotect_data_domain | v < 6.2.1.110, 7.0 ≤ v < 7.12.0.0 | 6.2.1.110, 7.12.0.0 |
| dell apex_protection_storage | v < 6.2.1.110, 7.0 ≤ v < 7.10.1.15 | 6.2.1.110, 7.10.1.15 |
| dell powerprotect_data_domain_management_center | v < 6.2.1.110, 7.0 ≤ v < 7.13.0.10, 7.7 ≤ v < 7.7.5.25, 7.10 ≤ v < 7.10.1.15 | 6.2.1.110, 7.13.0.10, 7.7.5.25, 7.10.1.15 |
| dell emc_data_domain_os | v < 6.2.1.110, 7.0 ≤ v < 7.12.0.0, 7.7 ≤ v < 7.7.5.25, 7.10 ≤ v < 7.10.1.15 | 6.2.1.110, 7.12.0.0, 7.7.5.25, 7.10.1.15 |
| dell powerprotect_data_protection | v < 2.7.6 | 2.7.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.