6.7

CVE-2026-35153

Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an
improper neutralization of argument delimiters in a command ('argument injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution
 with root privileges.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dell ≫ Data Domain Operating System Version >= 7.7.1.0 < 7.13.1.70
Dell ≫ Data Domain Operating System Version >= 7.14.0.0 < 8.3.1.30
Dell ≫ Data Domain Operating System Version >= 8.4.0.0 < 8.6.1.10
Dell ≫ Data Domain Operating System Version 8.7.0.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.117
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
EMC 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
Vendor Advisory