CVE-2025-29987

High

Description

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulnerability. An authenticated user from a trusted remote client could exploit this vulnerability to execute arbitrary commands with root privileges.

SeverityHigh

CVSS8.8

Exploit probability—

ProductDell Powerprotect Data Domain

PublishedApr 3, 2025

First seenApr 3, 2025

Weakness typeCWE-1220CWE-1220

How to fix

Update

dell powerprotect_data_domain7.10.1.60 or later
dell data_domain_operating_system7.10.1.60, 7.13.1.25, 8.3.0.15 or later
dell powerprotect_dm5500_firmware5.19.0.0 or later

Vendor advisories

dell.com/support/kbdoc/en-us/000300899/dsa-2025-139-dell-technologies-powerprotect-data-domain-security-update-for-a-security-vulnerability

Affected products

Product	Affected versions	Fixed in
dell powerprotect_data_domain	v < 7.10.1.60	7.10.1.60
dell data_domain_operating_system	7.10.1.0 ≤ v < 7.10.1.60, 7.13.1.0 ≤ v < 7.13.1.25, 8.3.0.0 ≤ v < 8.3.0.15	7.10.1.60, 7.13.1.25, 8.3.0.15
dell powerprotect_dm5500_firmware	5.12 ≤ v < 5.19.0.0	5.19.0.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.