CVE-2025-30099 Overview
CVE-2025-30099 is an OS Command Injection vulnerability [CWE-78] affecting Dell PowerProtect Data Domain systems running Data Domain Operating System (DD OS). The flaw resides in the DDSH command-line interface (CLI) and stems from improper neutralization of special elements passed to operating system commands. A locally authenticated attacker with low privileges can inject arbitrary commands that execute with root privileges, resulting in full compromise of the appliance.
Affected releases include DD OS Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 releases 7.13.1.0 through 7.13.1.25, and LTS2023 releases 7.10.1.0 through 7.10.1.50.
Critical Impact
Successful exploitation grants root-level command execution on Dell PowerProtect Data Domain appliances, exposing enterprise backup data to tampering, exfiltration, and destruction.
Affected Products
- Dell PowerProtect Data Domain — DD OS Feature Release 7.7.1.0 through 8.1.0.10
- Dell PowerProtect Data Domain — DD OS LTS2024 7.13.1.0 through 7.13.1.25
- Dell PowerProtect Data Domain — DD OS LTS2023 7.10.1.0 through 7.10.1.50
Discovery Timeline
- 2025-08-04 - CVE-2025-30099 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30099
Vulnerability Analysis
The vulnerability exists in the DDSH CLI, the administrative shell exposed by DD OS for managing Data Domain appliances. The CLI accepts operator input and passes portions of it to underlying operating system commands without adequately neutralizing shell metacharacters. This mismatch between the CLI's privilege boundary and the trust it places in user-supplied arguments enables command injection.
Because DDSH commands run with elevated backend privileges, injected payloads execute as root even though the attacker authenticates as a low-privileged local user. The attacker does not need to escape a chroot or defeat additional privilege boundaries — the CLI itself brokers the privileged execution.
Root Cause
The root cause is improper neutralization of special elements used in an OS command [CWE-78]. DDSH constructs command strings that concatenate untrusted operator input with system utilities. Metacharacters such as ;, |, &&, backticks, and $(...) are not stripped or safely quoted before the shell interprets them, allowing arbitrary command chaining.
Attack Vector
Exploitation requires local access to the appliance and valid low-privilege credentials for the DDSH CLI. An authenticated attacker submits a crafted DDSH command containing shell metacharacters within an argument that is passed to the underlying OS. When the CLI dispatches the constructed command line, the injected payload executes as root, yielding full control over the Data Domain filesystem, backup data, and system services.
Refer to the Dell Security Advisory DSA-2025-159 for vendor-supplied technical details.
Detection Methods for CVE-2025-30099
Indicators of Compromise
- Unexpected root-owned processes spawned as child processes of DDSH CLI sessions.
- DDSH audit log entries containing shell metacharacters such as ;, |, &&, backticks, or $(...) in command arguments.
- New or modified files in system directories that correlate in time with low-privileged CLI sessions.
- Outbound network connections initiated from the Data Domain appliance to unfamiliar destinations following CLI activity.
Detection Strategies
- Review DDSH CLI audit logs for command arguments containing shell control characters or command substitution syntax.
- Correlate low-privileged user sessions with process creations owned by root on the appliance.
- Baseline normal DDSH command usage per administrator account and alert on deviations.
Monitoring Recommendations
- Forward DD OS system, audit, and authentication logs to a centralized SIEM for retention and correlation.
- Monitor for privilege transitions where a low-privileged CLI session results in root-context execution.
- Alert on configuration changes, new local accounts, or SSH key additions made shortly after CLI logins from non-administrative users.
How to Mitigate CVE-2025-30099
Immediate Actions Required
- Apply the fixed DD OS release identified in Dell advisory DSA-2025-159 to all affected Data Domain appliances.
- Restrict DDSH CLI access to a minimal set of trusted administrators and enforce strong authentication.
- Rotate credentials for any local accounts that had DDSH access prior to patching.
- Audit recent DDSH command history for signs of command injection attempts.
Patch Information
Dell has released fixed DD OS versions addressing this vulnerability. Consult the Dell Security Update DSA-2025-159 for the specific patched build numbers for Feature Release, LTS2024, and LTS2023 tracks, and upgrade according to Dell's documented procedure.
Workarounds
- Limit local and network access to the Data Domain management interfaces to jump hosts on a restricted management VLAN.
- Disable or remove low-privileged local accounts that do not require DDSH CLI access until the patch is applied.
- Enable and centralize DDSH audit logging to detect exploitation attempts prior to remediation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
