CVE-2025-29987

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-29987", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "state": "PUBLISHED", "assignerShortName": "dell", "dateReserved": "2025-03-13T05:03:56.322Z", "datePublished": "2025-04-03T15:18:06.144Z", "dateUpdated": "2026-02-26T18:28:57.797Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "DD OS 8.3", "vendor": "Dell", "versions": [{"lessThanOrEqual": "8.3.0.10", "status": "affected", "version": "7.7.1.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "DD OS 7.13", "vendor": "Dell", "versions": [{"lessThanOrEqual": "7.13.1.20", "status": "affected", "version": "7.13.1.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "DD OS 7.10", "vendor": "Dell", "versions": [{"lessThanOrEqual": "7.10.1.50", "status": "affected", "version": "7.10.1.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "PowerProtect DP Series Appliance (IDPA)", "vendor": "Dell", "versions": [{"lessThan": "2.7.8", "status": "affected", "version": "N/A", "versionType": "semver"}]}], "datePublic": "2025-04-02T06:30:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulnerability. An authenticated user from a trusted remote client could exploit this vulnerability to execute arbitrary commands with root privileges.<br>"}], "value": "Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulnerability. An authenticated user from a trusted remote client could exploit this vulnerability to execute arbitrary commands with root privileges."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1220", "description": "CWE-1220: Insufficient Granularity of Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2025-04-03T15:18:06.144Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000300899/dsa-2025-139-dell-technologies-powerprotect-data-domain-security-update-for-a-security-vulnerability"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-29987", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-05T03:55:36.340980Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T18:28:57.797Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-29987", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-03T15:43:36.120798Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-03T15:43:41.123Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dell", "product": "DD OS 8.3", "versions": [{"status": "affected", "version": "7.7.1.0", "versionType": "semver", "lessThanOrEqual": "8.3.0.10"}], "defaultStatus": "unaffected"}, {"vendor": "Dell", "product": "DD OS 7.13", "versions": [{"status": "affected", "version": "7.13.1.0", "versionType": "semver", "lessThanOrEqual": "7.13.1.20"}], "defaultStatus": "unaffected"}, {"vendor": "Dell", "product": "DD OS 7.10", "versions": [{"status": "affected", "version": "7.10.1.0", "versionType": "semver", "lessThanOrEqual": "7.10.1.50"}], "defaultStatus": "unaffected"}, {"vendor": "Dell", "product": "PowerProtect DP Series Appliance (IDPA)", "versions": [{"status": "affected", "version": "N/A", "lessThan": "2.7.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2025-04-02T06:30:00.000Z", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000300899/dsa-2025-139-dell-technologies-powerprotect-data-domain-security-update-for-a-security-vulnerability", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulnerability. An authenticated user from a trusted remote client could exploit this vulnerability to execute arbitrary commands with root privileges.", "supportingMedia": [{"type": "text/html", "value": "Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulnerability. An authenticated user from a trusted remote client could exploit this vulnerability to execute arbitrary commands with root privileges.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1220", "description": "CWE-1220: Insufficient Granularity of Access Control"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2025-04-03T15:18:06.144Z"}}}, "cveMetadata": {"cveId": "CVE-2025-29987", "state": "PUBLISHED", "dateUpdated": "2025-04-05T03:55:35.210Z", "dateReserved": "2025-03-13T05:03:56.322Z", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "datePublished": "2025-04-03T15:18:06.144Z", "assignerShortName": "dell"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "DD OS 8.3", "vendor": "Dell", "versions": [{"lessThanOrEqual": "8.3.0.10", "status": "affected", "version": "7.7.1.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "DD OS 7.13", "vendor": "Dell", "versions": [{"lessThanOrEqual": "7.13.1.20", "status": "affected", "version": "7.13.1.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "DD OS 7.10", "vendor": "Dell", "versions": [{"lessThanOrEqual": "7.10.1.50", "status": "affected", "version": "7.10.1.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "PowerProtect DP Series Appliance (IDPA)", "vendor": "Dell", "versions": [{"lessThan": "2.7.8", "status": "affected", "version": "N/A", "versionType": "semver"}]}], "source": "security_alert@emc.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dell:powerprotect_data_domain:*:*:*:*:lts:*:*:*", "matchCriteriaId": "F86F2074-D522-4CF7-BE0C-F211FDD19344", "versionEndExcluding": "7.10.1.60", "vulnerable": true}, {"criteria": "cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "29E08B01-7808-45DD-82E0-FCA75113F822", "versionEndExcluding": "7.10.1.60", "versionStartIncluding": "7.10.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "E8280B59-5A9F-43B2-8F79-FB3C5E374A88", "versionEndExcluding": "7.13.1.25", "versionStartIncluding": "7.13.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "99AB8E9D-51E5-45F6-8C03-D0AFBDA203FA", "versionEndExcluding": "8.3.0.15", "versionStartIncluding": "8.3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dell:powerprotect_dm5500_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "BB41A99B-FEA7-47E2-B819-82AC0E089C72", "versionEndExcluding": "5.19.0.0", "versionStartIncluding": "5.12", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dell:powerprotect_dm5500:-:*:*:*:*:*:*:*", "matchCriteriaId": "A4202214-1F62-4F67-B39C-0F7A02DADB85", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulnerability. An authenticated user from a trusted remote client could exploit this vulnerability to execute arbitrary commands with root privileges."}, {"lang": "es", "value": "Las versiones de Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) anteriores a la 8.3.0.15 presentan una vulnerabilidad de control de acceso con granularidad insuficiente. Un usuario autenticado de un cliente remoto de confianza podr\u00eda aprovechar esta vulnerabilidad para ejecutar comandos arbitrarios con privilegios de root."}], "id": "CVE-2025-29987", "lastModified": "2026-06-17T09:06:01.857", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security_alert@emc.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-29987", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-04-05T03:55:36.340980Z", "version": "2.0.3"}}]}, "published": "2025-04-03T16:15:36.420", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000300899/dsa-2025-139-dell-technologies-powerprotect-data-domain-security-update-for-a-security-vulnerability"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1220"}], "source": "security_alert@emc.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}