CVE-2025-46606
Improper Authentication Restriction in Dell PowerProtect DD OS Allows Unauthorized Access
Publication date: 2026-04-17
Last updated on: 2026-04-17
Assigner: Dell
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dell | powerprotect_data_domain | From 8.4 (inc) to 8.5 (inc) |
| dell | data_domain_operating_system | From 8.4 (inc) to 8.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-307 | The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions 8.4 through 8.5. It involves improper restriction of excessive authentication attempts, which means the system does not adequately limit the number of login tries. A high privileged attacker with remote access could exploit this flaw to gain unauthorized access.
How can this vulnerability impact me? :
The impact of this vulnerability is that a high privileged attacker could potentially gain unauthorized access to the system remotely. This could lead to compromise of confidentiality and integrity of data, as well as limited availability impact.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a high privileged attacker with remote access to potentially gain unauthorized access by exploiting improper restriction of excessive authentication attempts.
Unauthorized access to sensitive data or systems can lead to violations of compliance requirements under standards such as GDPR and HIPAA, which mandate strict controls on data confidentiality and access.
Therefore, if exploited, this vulnerability could negatively impact an organization's ability to comply with these regulations by exposing protected data or systems to unauthorized users.