Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Heap-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Privilege Management vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and certain LTS releases contain an OS command injection vulnerability (CWE-78). This flaw allows a high privileged remote attacker to execute arbitrary commands on the affected system. The vulnerability is addressed in versions 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later, and 7.13.1.90 or later. The CVSS 3.1 score is 7.2, indicating high severity with impacts on confidentiality, integrity, and availability.
Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain a critical improper authentication vulnerability (CWE-862). An unauthenticated remote attacker could exploit this flaw to create privileged accounts, potentially gaining full control of the system. Dell has released fixed versions starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 onwards and recommends upgrading promptly.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain a path traversal vulnerability (CWE-22). This flaw allows a low privileged attacker with remote access to potentially access the filesystem beyond intended restrictions. The vulnerability is rated high severity with a CVSS score of 8.8. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain an OS Command Injection vulnerability (CWE-78). A high privileged attacker with remote access could exploit this flaw to execute arbitrary commands on the affected system. The vulnerability is rated high severity with a CVSS score of 7.2. Fixed versions are available starting from 8.9.0.0, 8.6.1.30, 8.3.1.50, and 7.13.1.90 depending on the release stream.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain an improper authentication vulnerability (CWE-287). This flaw allows an unauthenticated remote attacker to execute arbitrary commands with root privileges, resulting in full system compromise. The vulnerability is rated critical with a CVSS score of 9.8. Dell has released fixed versions starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 and recommends upgrading as soon as possible.
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. This vulnerability could impact other managed Data Domain systems.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain an SQL Injection vulnerability (CWE-89). A high privileged attacker with remote access could exploit this flaw to disclose information. The vulnerability has a low CVSS score of 2.7 and does not impact integrity or availability. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 depending on the release line.
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Validation of Integrity Check Value vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Path Traversal vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain an SQL Injection vulnerability (CWE-89). This flaw allows a high privileged remote attacker to potentially disclose information. The vulnerability has a low CVSS score of 2.7 and does not impact integrity or availability. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 depending on the release line.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including several LTS releases, contain a SQL Injection vulnerability (CWE-89). This flaw allows a high privileged remote attacker to potentially disclose information. The vulnerability has a low CVSS score of 2.7 and does not impact integrity or availability. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0.
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1_grp[0][txt] (wysiwyg field inside group — field id controlled by integrator config)' parameter in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when a site integrator renders the plugin's documented front-end form helper with a wysiwyg field inside a repeatable group on a publicly accessible page.
Multiple fraudulent websites impersonating legitimate Korean companies such as Doosan Robotics and Cheonjeong have been discovered. These sites use authentic corporate branding and offer features like invitation-code registration, VIP memberships, and cryptocurrency deposit/withdrawal functions. They instruct victims to make USDT payments via TRON wallet addresses and submit transaction screenshots. Analysis identified TRON wallets with significant transaction volumes, including one with approximately 13 million USDT received. Infrastructure tracking linked these domains to the ValleyRAT malware command and control IP address, but no direct operational connection between ValleyRAT malware and the fraudulent websites or wallets has been confirmed.