CVE-2025-43727

{
  "id": "CVE-2025-43727",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-07T20:15:34.513",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an incorrect Implementation of Authentication Algorithm vulnerability in the RestAPI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."
    },
    {
      "lang": "es",
      "value": "Dell PowerProtect Data Domain con Data Domain Sistema Operativo (DD OS) de las versiones de Feature Release 7.7.1.0 hasta 8.1.0.10, versiones de lanzamiento LTS2024 7.13.1.0 hasta 7.13.1.25, versiones de lanzamiento LTS 2023 7.10.1.0 hasta 7.10.1.50, contienen una vulnerabilidad de implementación incorrecta del algoritmo de autenticación en la RestAPI. Un atacante no autenticado con acceso remoto podría potencialmente explotar esta vulnerabilidad, lo que lleva a un acceso no autorizado."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Dell",
          "product": "PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "7.7.1.0",
              "lessThan": "8.3.0.10",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Dell",
          "product": "PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "7.13.1.0",
              "lessThan": "7.13.1.30",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Dell",
          "product": "PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "7.10.1.0",
              "lessThan": "7.10.1.60",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-08T15:44:30.369592Z",
          "id": "CVE-2025-43727",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-303"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "7.7.1.0",
              "versionEndExcluding": "7.10.1.60",
              "matchCriteriaId": "F2389C08-162A-4D43-B1EA-D93D7DB51781"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "7.13.1.0",
              "versionEndExcluding": "7.13.1.30",
              "matchCriteriaId": "5E7EC11C-C065-48D9-A036-5A17653D44EA"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.0.0.0",
              "versionEndExcluding": "8.3.0.10",
              "matchCriteriaId": "FD518568-542A-420D-B0E6-6F35E127E5CE"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000348708/dsa-2025-159-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}