PowerProtect Data Domainに重大な脆弱性、修正版あり
Summary
Dell PowerProtect Data Domainに、認証なしでroot権限のコマンドを実行されるおそれのある脆弱性が見つかりました。Feature ReleaseとLTS2024・LTS2025・LTS2026の各系列が対象で、修正版が出ています。バックアップ基盤として運用している組織は、版を確認して更新の段取りに入ってください。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
Dell PowerProtect Data Domainに、認証なしでroot権限のコマンドを実行されるおそれのある脆弱性が見つかりました。Feature ReleaseとLTS2024・LTS2025・LTS2026の各系列が対象で、修正版が出ています。バックアップ基盤として運用している組織は、版を確認して更新の段取りに入ってください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Dell | PowerProtect Data Domain |
< 8.9.0.0 or later < 7.13.1.90 or later < 8.3.1.50 or later < 8.6.1.30 or later |
8.9.0.0 or later 7.13.1.90 or later 8.3.1.50 or later 8.6.1.30 or later |
Original description The description as published by the source.
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. This is a critical severity vulnerability as it allows an attacker to take complete control of the system. Dell recommends customers to upgrade at the earliest opportunity.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web security_alert@emc.com
- web nvd.nist.gov
- web github.com