CVE-2025-43727

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-43727", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "state": "PUBLISHED", "assignerShortName": "dell", "dateReserved": "2025-04-17T05:03:55.667Z", "datePublished": "2025-10-07T19:26:42.099Z", "dateUpdated": "2025-10-08T15:44:38.614Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release", "vendor": "Dell", "versions": [{"lessThan": "8.3.0.10", "status": "affected", "version": "7.7.1.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024", "vendor": "Dell", "versions": [{"lessThan": "7.13.1.30", "status": "affected", "version": "7.13.1.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023", "vendor": "Dell", "versions": [{"lessThan": "7.10.1.60", "status": "affected", "version": "7.10.1.0", "versionType": "semver"}]}], "datePublic": "2025-10-06T17:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an incorrect Implementation of Authentication Algorithm vulnerability in the RestAPI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."}], "value": "Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an incorrect Implementation of Authentication Algorithm vulnerability in the RestAPI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-303", "description": "CWE-303: Incorrect Implementation of Authentication Algorithm", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2025-10-07T19:26:42.099Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000348708/dsa-2025-159-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-08T15:44:30.369592Z", "id": "CVE-2025-43727", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-08T15:44:38.614Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-43727", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-08T15:44:30.369592Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-08T15:44:33.490Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dell", "product": "PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release", "versions": [{"status": "affected", "version": "7.7.1.0", "lessThan": "8.3.0.10", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Dell", "product": "PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024", "versions": [{"status": "affected", "version": "7.13.1.0", "lessThan": "7.13.1.30", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Dell", "product": "PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023", "versions": [{"status": "affected", "version": "7.10.1.0", "lessThan": "7.10.1.60", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2025-10-06T17:00:00.000Z", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000348708/dsa-2025-159-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an incorrect Implementation of Authentication Algorithm vulnerability in the RestAPI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.", "supportingMedia": [{"type": "text/html", "value": "Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an incorrect Implementation of Authentication Algorithm vulnerability in the RestAPI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-303", "description": "CWE-303: Incorrect Implementation of Authentication Algorithm"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2025-10-07T19:26:42.099Z"}}}, "cveMetadata": {"cveId": "CVE-2025-43727", "state": "PUBLISHED", "dateUpdated": "2025-10-08T15:44:38.614Z", "dateReserved": "2025-04-17T05:03:55.667Z", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "datePublished": "2025-10-07T19:26:42.099Z", "assignerShortName": "dell"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release", "vendor": "Dell", "versions": [{"lessThan": "8.3.0.10", "status": "affected", "version": "7.7.1.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024", "vendor": "Dell", "versions": [{"lessThan": "7.13.1.30", "status": "affected", "version": "7.13.1.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023", "vendor": "Dell", "versions": [{"lessThan": "7.10.1.60", "status": "affected", "version": "7.10.1.0", "versionType": "semver"}]}], "source": "security_alert@emc.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "F2389C08-162A-4D43-B1EA-D93D7DB51781", "versionEndExcluding": "7.10.1.60", "versionStartIncluding": "7.7.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E7EC11C-C065-48D9-A036-5A17653D44EA", "versionEndExcluding": "7.13.1.30", "versionStartIncluding": "7.13.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "FD518568-542A-420D-B0E6-6F35E127E5CE", "versionEndExcluding": "8.3.0.10", "versionStartIncluding": "8.0.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an incorrect Implementation of Authentication Algorithm vulnerability in the RestAPI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."}, {"lang": "es", "value": "Dell PowerProtect Data Domain con Data Domain Sistema Operativo (DD OS) de las versiones de Feature Release 7.7.1.0 hasta 8.1.0.10, versiones de lanzamiento LTS2024 7.13.1.0 hasta 7.13.1.25, versiones de lanzamiento LTS 2023 7.10.1.0 hasta 7.10.1.50, contienen una vulnerabilidad de implementaci\u00f3n incorrecta del algoritmo de autenticaci\u00f3n en la RestAPI. Un atacante no autenticado con acceso remoto podr\u00eda potencialmente explotar esta vulnerabilidad, lo que lleva a un acceso no autorizado."}], "id": "CVE-2025-43727", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security_alert@emc.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-43727", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-08T15:44:30.369592Z", "version": "2.0.3"}}]}, "published": "2025-10-07T20:15:34.513", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000348708/dsa-2025-159-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-303"}], "source": "security_alert@emc.com", "type": "Secondary"}]}

{}

{"created": "2025-10-08T13:35:30.658550+00:00", "updated": "2025-10-08T13:35:30.658577+00:00", "vendors": ["dell", "dell$PRODUCT$data_domain_operating_system", "dell$PRODUCT$powerprotect_data_domain", "dell$PRODUCT$powerprotect_dd"]}