CVE-2025-43889

{
  "id": "CVE-2025-43889",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-07T19:15:36.800",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4, LTS2024 release Versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure."
    },
    {
      "lang": "es",
      "value": "Dell PowerProtect Data Domain con Data Domain Sistema Operativo (DD OS) de las versiones de Feature Release 7.7.1.0 hasta 8.4, LTS2024 release Versions 7.13.1.0 hasta 7.13.1.30, y versiones de LTS 2023 release 7.10.1.0 hasta 7.10.1.60, contienen una vulnerabilidad de Limitación Inapropiada de un Nombre de Ruta a un Directorio Restringido ('Salto de Ruta') en la interfaz de usuario. Un atacante no autenticado con acceso remoto podría potencialmente explotar esta vulnerabilidad, lo que llevaría a la exposición de información."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Dell",
          "product": "PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "7.7.1.0",
              "lessThan": "8.5.0.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Dell",
          "product": "PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "7.13.1.0",
              "lessThan": "7.13.1.40",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Dell",
          "product": "PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "7.10.1.0",
              "lessThan": "7.10.1.70",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-07T18:53:46.838511Z",
          "id": "CVE-2025-43889",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "7.7.1.0",
              "versionEndExcluding": "7.10.1.70",
              "matchCriteriaId": "7FCE50EA-F2B8-4455-A489-1947B0CBFEEA"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "7.13.1.0",
              "versionEndExcluding": "7.13.1.40",
              "matchCriteriaId": "C0EA46C5-6776-411A-8FBC-5B32BC216888"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.0.0.0",
              "versionEndExcluding": "8.5.0.0",
              "matchCriteriaId": "F5464021-E415-4D49-AE89-8190C9D4D6FA"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000376224/dsa-2025-333-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}