Paper/Archive/CVE-2025-36594

CVE-2025-36594

Dell PowerProtect Data Domain Feature Release — Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2024 rel…

EPSS 0.5%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 45.2.452 × 209.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Authentication Bypass by Spoofing vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Remote unauthenticated user can create account that potentially expose customer info, affect system integrity and availability.

Affected

ProductAffectedFixed inSource

PowerProtect Data Domain Feature Release7.7.1.0 – 8.3.0.15–CNA

PowerProtect Data Domain LTS20247.13.1.0 – 7.13.1.25–CNA

PowerProtect Data Domain LTS 20237.10.1.0 – 7.10.1.60–CNA

Scores by source

dell (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorydell.com/support/kbdoc/en-us/000348708/dsa-2025-159-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities