CVE-2025-30099 in PowerProtect Data Domain
Summary
by MITRE • 08/04/2025
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the DDSH CLI. A low privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/27/2025
The vulnerability identified as CVE-2025-30099 represents a critical operating system command injection flaw within Dell PowerProtect Data Domain systems running specific versions of the Data Domain Operating System. This vulnerability exists in the DDSH CLI component, which serves as a command-line interface for system administration tasks. The affected systems span multiple release branches including Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release versions 7.13.1.0 through 7.13.1.25, and LTS 2023 release versions 7.10.1.0 through 7.10.1.50, indicating a widespread impact across different system generations and support cycles. The vulnerability classification aligns with CWE-77 and follows the ATT&CK framework's T1059.003 technique for command and scripting interpreter, specifically targeting OS command execution pathways.
The technical flaw stems from improper neutralization of special elements within the DDSH CLI implementation, allowing attackers to inject malicious operating system commands through crafted input sequences. When legitimate commands are processed through the vulnerable interface, the system fails to properly sanitize user inputs before executing them as system commands. This inadequate input validation creates a pathway where an attacker can append malicious commands to legitimate system calls, effectively bypassing normal access controls and privilege boundaries. The vulnerability specifically affects local attackers with low privileged accounts who can leverage this flaw to escalate their privileges to root level execution, which represents a severe privilege escalation vulnerability within the system's security architecture.
The operational impact of this vulnerability extends beyond simple command execution capabilities, as it fundamentally compromises the system's integrity and confidentiality. An attacker exploiting this vulnerability can execute arbitrary commands with full root privileges, potentially leading to complete system compromise, data exfiltration, or persistent backdoor establishment. The low privilege requirement for exploitation makes this vulnerability particularly dangerous as it requires minimal initial access to achieve critical system control. Organizations utilizing affected Dell PowerProtect Data Domain systems face significant risk of unauthorized access to backup data repositories, potential disruption of critical backup operations, and possible lateral movement within network environments where these systems reside. The vulnerability's presence in both current and long-term support releases indicates that organizations across different maintenance cycles remain exposed to this risk.
Mitigation strategies for CVE-2025-30099 should prioritize immediate system updates to the latest available patches from Dell, which would address the underlying input validation flaws in the DDSH CLI component. Organizations should implement network segmentation to limit local access to these systems, reducing the attack surface for local privilege escalation attempts. Additional controls should include monitoring for suspicious command execution patterns within system logs, implementing least privilege principles for local user accounts, and conducting regular security assessments of system interfaces. The vulnerability's characteristics align with ATT&CK techniques emphasizing command execution and privilege escalation, making defensive measures such as input validation monitoring and process monitoring particularly effective. Security teams should also consider implementing automated patch management processes to ensure timely deployment of security updates across all affected system versions and release branches.