The vulnerability allows for “execution of arbitrary commands with root privileges,” essentially giving attackers complete control over affected systems. According to the security advisory, this vulnerability affects multiple versions of Dell’s data protection infrastructure. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Dell has released remediation patches to address this high-severity issue that affects multiple product lines across their enterprise backup and recovery portfolio. The core issue is classified as an “Insufficient Granularity of Access Control vulnerability” that could enable “an authenticated user from a trusted remote client” to gain unauthorized elevation of privileges. Dell has been actively revising its advisory documentation, with six updates between April 2 and 4, 2025, to provide comprehensive remediation guidance for all affected products. The vulnerability has received a CVSS Base Score of 8.8 (HIGH) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating its potential for significant damage if exploited. Customers should consult Dell’s knowledge base articles and remediation documentation for detailed upgrade instructions and product-specific guidance. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. Dell has rapidly developed and released patched versions to address this vulnerability. This is not the first time Dell PowerProtect products have faced security challenges. The exploitability score of 2.8 and impact score of 5.9 further underscore the significant risk posed to organizations using unpatched versions. Similar upgrade requirements apply to the Disk Library for mainframe DLm8500 (Version 5.4.0.0 or later) and DLm8700 (Version 7.0.0.0 or later). He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications. Previous vulnerabilities in the PowerProtect ecosystem, such as CVE-2023-44277 and CVE-2024-22445, have also allowed for arbitrary command execution.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 07 Apr 2025 09:30:17 +0000