CVE-2025-43727
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Dell PowerProtect Data Domain with DD OS contains an incorrect implementation of an authentication algorithm in the RestAPI. This affects Feature Release 7.7.1.0 through 8.1.0.10, LTS2024 7.13.1.0 through 7.13.1.25, and LTS 2023 7.10.1.0 through 7.10.1.50. An unauthenticated remote attacker could potentially exploit this to gain unauthorized access.
Risk Assessment
An unauthenticated attacker with network access may gain unauthorized access to the backup system, risking data disclosure or loss. This can undermine the confidentiality and integrity of data across the backup environment.
Recommendation
Update DD OS to a version containing the fix per Dell guidance. Restrict network access to the RestAPI to trusted addresses.
Other vulnerabilities in Dell PowerProtect Data Domain (DD OS)
See all- CVE-2026-28263Medium
Dell PowerProtect Data Domain with DD OS contains a cross-site scripting vulnerability. A high-privileged attacker with remote access could exploit it to inject scripts.
- CVE-2026-23777Medium
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) in Feature Release versions 7.7.1.0 through 8.5, LTS2025 8.3.1.0 through 8.3.1.20, and LTS2024 7.13.1.0 through 7.13.1.50 contains an exposure of sensitive information to an unauthorized actor vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure.
- CVE-2026-23779Medium
Dell PowerProtect Data Domain with DD OS in Feature Release versions 7.7.1.0 through 8.5, LTS2025 8.3.1.0 through 8.3.1.20, and LTS2024 7.13.1.0 through 7.13.1.50 contains a command injection vulnerability. A high-privileged attacker with local access could exploit it to gain root-level access.
Original NVD description (English source)
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an incorrect Implementation of Authentication Algorithm vulnerability in the RestAPI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS