CVE-2025-43725 Overview
Dell PowerProtect Data Manager contains an Incorrect Default Permissions vulnerability [CWE-276] in the Generic Application Agent component. The flaw affects versions 19.19 and 19.20 and allows a low-privileged local attacker to execute arbitrary code on the affected host. Dell disclosed the issue in security advisory DSA-2025-326 alongside multiple other PowerProtect Data Manager vulnerabilities.
The vulnerability requires local access and low privileges, but no user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the backup infrastructure, which typically holds sensitive enterprise data and privileged credentials.
Critical Impact
A low-privileged local user can escalate to code execution in the security context of the PowerProtect Data Manager Generic Application Agent, potentially gaining control over backup and restore operations.
Affected Products
- Dell PowerProtect Data Manager Generic Application Agent version 19.19
- Dell PowerProtect Data Manager Generic Application Agent version 19.20
- Systems running the Generic Application Agent for application-consistent backups
Discovery Timeline
- 2025-09-10 - CVE-2025-43725 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-43725
Vulnerability Analysis
The Generic Application Agent ships with insecure default file or directory permissions. Local users who should not have write or execute rights to agent resources can modify or replace components the agent later loads or executes. Because the agent runs with elevated privileges to perform backup and restore tasks, unauthorized modifications translate directly into code execution under a higher-privileged account.
This class of weakness, tracked as CWE-276 Incorrect Default Permissions, commonly appears when installers set overly permissive access control lists (ACLs) on binaries, configuration files, scripts, or service directories. Attackers do not need to defeat authentication or network controls, only to log in with a standard user account.
Root Cause
The root cause is improper permission assignment during installation or upgrade of the Generic Application Agent. Files and directories owned by the agent are writable by non-privileged users, breaking the security boundary between the low-privileged user context and the privileged service context.
Attack Vector
An attacker authenticates to a host running the vulnerable agent as any local user. The attacker then writes to an agent-owned file, replaces a script or binary loaded by the agent, or hijacks a plugin path. When the agent or a scheduled backup task next executes that resource, the attacker's payload runs with the agent's privileges. Refer to the Dell Security Update DSA-2025-326 for vendor technical details.
No public proof-of-concept exploit is available at the time of publication.
Detection Methods for CVE-2025-43725
Indicators of Compromise
- Unexpected modifications to files or directories owned by the PowerProtect Data Manager Generic Application Agent installation path.
- New or altered scripts, binaries, or dynamic libraries under the agent's working directories.
- Backup jobs spawning child processes that are not part of the standard agent workflow.
- Local user accounts writing to agent-owned paths shortly before privileged agent execution.
Detection Strategies
- Audit filesystem ACLs on the Generic Application Agent install directory and flag world-writable or user-writable entries.
- Enable file integrity monitoring on agent binaries, configuration files, and plugin directories.
- Correlate low-privileged user file writes with subsequent privileged process execution from the same paths.
Monitoring Recommendations
- Forward endpoint process and file telemetry to a centralized data lake for retrospective hunting.
- Alert on process lineage where the agent service launches non-vendor binaries or interpreters.
- Track authentication and session activity on backup hosts to identify unusual local logins preceding agent execution.
How to Mitigate CVE-2025-43725
Immediate Actions Required
- Apply the Dell-provided fixed version referenced in DSA-2025-326 to all hosts running Generic Application Agent 19.19 or 19.20.
- Inventory systems running the Generic Application Agent and prioritize those hosting sensitive applications such as databases.
- Restrict interactive local logon to backup hosts to administrators and service accounts only.
- Review and harden ACLs on the agent installation directory as an interim compensating control.
Patch Information
Dell has released fixed versions of PowerProtect Data Manager as documented in security advisory DSA-2025-326. Administrators should consult the Dell Security Update DSA-2025-326 for the specific fixed build numbers and upgrade procedures for the Generic Application Agent.
Workarounds
- Manually tighten permissions on the Generic Application Agent installation directory so only privileged accounts have write access.
- Remove unnecessary local user accounts from systems that host the agent.
- Apply the principle of least privilege to application service accounts that interact with the agent until patching is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
