PowerProtect Data Domainに認証不備の脆弱性、修正版あり
Summary
Dellのバックアップ装置PowerProtect Data Domainに、特権アカウントを勝手に作られる脆弱性が見つかりました。DD OSの複数の系統が対象で、系統ごとに修正版が出ています。使っている組織は、まず版を確認し、更新の段取りを組んでください。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
Dellのバックアップ装置PowerProtect Data Domainに、特権アカウントを勝手に作られる脆弱性が見つかりました。DD OSの複数の系統が対象で、系統ごとに修正版が出ています。使っている組織は、まず版を確認し、更新の段取りを組んでください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Dell | PowerProtect Data Domain |
< 8.9.0.0 or later < 7.13.1.90 or later < 8.3.1.50 or later < 8.6.1.30 or later |
8.9.0.0 or later 7.13.1.90 or later 8.3.1.50 or later 8.6.1.30 or later |
Original description The description as published by the source.
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to privileged account creation. This is a critical severity vulnerability as it allows an attacker to take complete control of the system. Dell recommends customers to upgrade at the earliest opportunity.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web security_alert@emc.com
- web nvd.nist.gov
- web github.com