Dell OpenManage Enterprise (OME), Dell's central console for managing Dell servers and hardware, contains an OS command injection flaw (CWE-78) in versions prior to 4.8.0. An attacker with remote access and a low-privileged account can inject operating system commands and execute them on the appliance, with high impact on confidentiality, integrity and availability. The CVSS 3.1 score from the CNA is 8.8; VulDB lists 9.9, so the vendor score should be used for prioritisation.
Dell · OpenManage Enterprise
Dell OpenManage Enterprise versions prior to 4.8.0 contain an OS command injection vulnerability (CWE-78). An attacker with low privileges and remote network access could potentially execute commands on the management server. The CNA rates the issue with CVSS 3.1 8.8 (High); NVD analysis was still pending at the time of writing.
Dell · OpenManage Enterprise
A stack-based buffer overflow (CWE-121) in DD OS, the operating system of Dell PowerProtect Data Domain backup appliances, allows an attacker with low-privileged remote access to potentially gain unauthorized access. Authentication is required, so an attacker needs a valid low-privileged account on the appliance. CVSS 3.1 base score is 8.8 (High).
Dell · PowerProtect Data Domain
Dell PowerProtect Data Domain Management Center contains a missing authorization flaw (CWE-862) in several release lines. An attacker with a low-privileged account and network access to the management interface can perform unauthorized operations on managed systems, with scope change and high impact on integrity and availability. No user interaction is required. The CVSS 3.1 score of 9.6 comes from the CNA; NVD analysis is still pending.
Dell · PowerProtect Data Domain Management Center
An SQL injection flaw (CWE-89) in the management component of Dell PowerProtect Data Domain Management Center allows an authenticated attacker with low privileges and remote network access to inject SQL commands. According to the CNA, this can lead to unauthorized access to managed systems. The CVSS score of 9.6 reflects a scope change. Exploitation requires a valid low-privileged account; no public exploit and no exploitation in the wild are known.
Dell · PowerProtect Data Domain Management Center
A stack-based buffer overflow in Dell PowerProtect Data Domain (DD OS) allows an unauthenticated remote attacker to potentially execute commands on affected appliances. No authentication is required, and the CVSS 3.1 base score is 9.8 (critical). Data Domain is a disk-based backup and recovery target, so a compromise could endanger the recovery copies that ransomware recovery depends on.
Dell · PowerProtect Data Domain
Dell PowerProtect Data Domain (DD OS) feature release versions 7.7.1.0 through 8.8 contain an Improper Check for Dropped Privileges vulnerability (CWE-273). A low-privileged user with remote network access can potentially escalate privileges, which Dell rates as High (CVSS 8.8) with full impact on confidentiality, integrity and availability. The attack requires a valid low-privileged account and no user interaction. The flaw is part of Dell's wider DSA-2026-416 update, which also covers several unauthenticated critical flaws.
Dell · PowerProtect Data Domain
Dell PowerProtect Data Domain contains a hard-coded cryptographic key (CWE-321). An unauthenticated remote attacker can potentially obtain credentials, which may then be used with the privileges of the compromised user. The CVSS base score is 9.8 (CRITICAL), and the flaw is in the same advisory as several other critical vulnerabilities.
Dell · PowerProtect Data Domain
Dell PowerProtect Data Domain Management Center in several Feature Release and LTS versions contains an authentication bypass by spoofing (CWE-290). A remote attacker with a low-privileged account can exploit it to escalate privileges, and the flaw could affect other managed Data Domain systems. Dell rates the issue critical (CVSS 3.1: 9.1), but the sources disagree on the exact score and CWE, so the Dell advisory is the authority.
Dell · PowerProtect Data Domain Management Center
Dell PowerProtect Data Domain backup appliances in several DD OS release lines contain an improper authentication flaw (CWE-287). An unauthenticated remote attacker can potentially execute arbitrary commands with root privileges, which gives full control of the system. Exposure of the management or data interfaces to untrusted networks is the key condition.
Dell · PowerProtect Data Domain
Dell PowerProtect Data Domain (DD OS) contains a path traversal flaw (CWE-22). A remote attacker with low privileges can use it to access the filesystem. The CNA rates the impact as high for confidentiality, integrity and availability. No exploitation in the wild and no public proof of concept are known at publication.
Dell · PowerProtect Data Domain
Dell PowerProtect Data Domain (DD OS) backup appliances in several release lines contain a critical flaw that allows unauthenticated attackers with network access to create privileged accounts. An attacker who can reach the management interface could gain complete control of the system, including access to backup data. Dell rates the CVSS v3.1 base score at 9.8. The CVE record classifies the weakness as CWE-862 (Missing Authorization), while the description calls it an improper authentication issue.
Dell · PowerProtect Data Domain
Dell PowerProtect Data Domain backup appliances contain an OS command injection vulnerability (CWE-78) that is rated High (CVSS 8.8) in the CNA record. An attacker with a low-privileged account and remote access can inject operating system commands and execute them on the appliance, which can lead to full compromise of confidentiality, integrity and availability. The attack requires valid low-privileged credentials, and the same Dell advisory DSA-2026-416 also contains unauthenticated flaws that are more severe.
Dell · PowerProtect Data Domain
Dell Application Store versions prior to 26.05.0.7 lack authentication for a critical function. An unauthenticated attacker on the same network segment (adjacent network access) could potentially execute arbitrary code on the affected device. No user interaction or privileges are required, and the impact on confidentiality, integrity and availability is rated high.
Dell · Application Store
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
