CVE-2026-23779
Command Injection in Dell PowerProtect DD OS Allows Root Access
Publication date: 2026-04-17
Last updated on: 2026-04-20
Assigner: Dell
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dell | data_domain_operating_system | From 8.3.1.0 (inc) to 8.3.1.20 (exc) |
| dell | powerprotect_dp_series_appliance | to 2.7.9 (exc) |
| dell | data_domain_operating_system | From 7.7.1.0 (inc) to 7.13.1.50 (exc) |
| dell | data_domain_operating_system | From 8.4.0.0 (inc) to 8.6.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions 7.7.1.0 through 8.5, including certain LTS2025 and LTS2024 release versions. It is a command injection vulnerability that allows a highly privileged attacker with local access to potentially execute arbitrary commands on the system.
Exploiting this vulnerability could allow the attacker to gain root-level access, which means full control over the affected system.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an attacker with high privileges and local access to gain root-level access to the affected system.
This level of access could lead to complete compromise of the system, including unauthorized data access, modification, deletion, or disruption of services.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows a high privileged attacker with local access to potentially gain root-level access through command injection in Dell PowerProtect Data Domain systems. This level of unauthorized access could lead to compromise of sensitive data, impacting confidentiality, integrity, and availability.
Such a compromise could affect compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive personal and health information against unauthorized access and breaches.
However, specific impacts on compliance or regulatory requirements are not detailed in the provided information.