CVE-2025-43887: Dell PowerProtect Privilege Escalation

CVE-2025-43887 Overview

CVE-2025-43887 is an Incorrect Default Permissions vulnerability [CWE-276] affecting Dell PowerProtect Data Manager versions 19.19 and 19.20 in Hyper-V deployments. A low-privileged attacker with local access can leverage the weak permission configuration to elevate privileges on the affected system. Dell issued a security advisory (DSA-2025-326) addressing this and other issues in PowerProtect Data Manager. The vulnerability affects backup and recovery infrastructure, which is a common target for adversaries seeking to disrupt disaster recovery capabilities before deploying destructive payloads.

Critical Impact
Local attackers with limited privileges can escalate to higher privileges on PowerProtect Data Manager Hyper-V systems, compromising confidentiality, integrity, and availability of backup infrastructure.

Affected Products

Dell PowerProtect Data Manager version 19.19 (Hyper-V)
Dell PowerProtect Data Manager version 19.20 (Hyper-V)
Backup infrastructure deployed on Microsoft Hyper-V virtualization

Discovery Timeline

2025-09-10 - CVE-2025-43887 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43887

Vulnerability Analysis

The vulnerability stems from incorrect default permissions applied to resources within Dell PowerProtect Data Manager on Hyper-V. When the product installs or configures files, directories, or service objects, permissions grant broader access than required for normal operation. A local attacker holding standard user credentials can interact with these overly permissive resources to gain elevated rights.

Common manifestations of CWE-276 include world-writable configuration files, service binaries modifiable by non-administrative users, or scheduled tasks running as SYSTEM that reference user-writable paths. Exploitation typically involves replacing or modifying a trusted file that a privileged process later executes or loads. The attacker then inherits the privileges of the higher-integrity process.

Because PowerProtect Data Manager operates with SYSTEM-level or backup-operator privileges to protect enterprise data, successful escalation yields substantial control over backup catalogs, credentials, and stored recovery data. This exposure is particularly relevant in environments where ransomware operators seek to disable or corrupt backups prior to encryption.

Root Cause

The root cause is misconfigured default access control on installation artifacts or runtime resources within the Hyper-V variant of PowerProtect Data Manager. The permissions granted to non-privileged users exceed what is necessary, violating the principle of least privilege as classified by CWE-276.

Attack Vector

Exploitation requires local access to the affected system and a set of low-privileged credentials. No user interaction is needed. The attacker identifies a resource with weak permissions, modifies it to introduce attacker-controlled content or logic, and waits for or triggers execution by a privileged component. Dell has not published exploitation details, and no public proof-of-concept is available at the time of writing. Refer to the Dell Security Update Advisory (DSA-2025-326) for vendor guidance.

Detection Methods for CVE-2025-43887

Indicators of Compromise

Unexpected modifications to PowerProtect Data Manager installation directories, binaries, or configuration files by non-administrative accounts
Creation of new services, scheduled tasks, or auto-start entries referencing PowerProtect paths
Anomalous process launches spawned by PowerProtect service accounts running under elevated context
Local privilege escalation events on Hyper-V hosts running vulnerable PPDM versions

Detection Strategies

Audit file system Access Control Lists (ACLs) on PowerProtect Data Manager directories and flag entries granting write or modify rights to standard users or groups such as Users or Authenticated Users
Monitor for write operations to service binaries, DLLs, or scripts within the PPDM install path originating from non-privileged security contexts
Correlate low-privileged process activity with subsequent SYSTEM-level process creation on PPDM Hyper-V hosts

Monitoring Recommendations

Enable Windows security auditing for object access on PowerProtect Data Manager directories and forward events to a centralized SIEM
Track integrity of PPDM service executables using file integrity monitoring and alert on unauthorized changes
Baseline expected parent-child process relationships for PPDM services and alert on deviations

How to Mitigate CVE-2025-43887

Immediate Actions Required

Apply the security update referenced in Dell advisory DSA-2025-326 to affected PowerProtect Data Manager 19.19 and 19.20 Hyper-V deployments
Inventory all PPDM Hyper-V instances and confirm patch status through configuration management tools
Restrict interactive and remote local access to PPDM hosts to administrative personnel only
Rotate credentials for accounts with local access to PPDM systems following patching

Patch Information

Dell has released fixed versions addressing CVE-2025-43887. Administrators should consult the Dell Security Update Advisory (DSA-2025-326) for the specific remediated release and upgrade procedure applicable to Hyper-V environments. Apply the patch within your organization's standard maintenance window for high-severity backup infrastructure vulnerabilities.

Workarounds

Manually harden Access Control Lists on PowerProtect Data Manager installation directories to remove write and modify permissions from non-administrative users until patching is complete
Enforce least-privilege access on Hyper-V hosts and remove unnecessary local user accounts
Segment backup infrastructure onto isolated management networks to limit local access exposure
Deploy application allowlisting to prevent execution of unauthorized binaries from PPDM directories

bash

# Configuration example: audit ACLs on PowerProtect Data Manager install path (Windows PowerShell)
Get-ChildItem -Path 'C:\Program Files\DPSAPPS' -Recurse |
    Get-Acl |
    Where-Object { $_.Access | Where-Object {
        $_.IdentityReference -match 'Users|Authenticated Users' -and
        $_.FileSystemRights -match 'Write|Modify|FullControl'
    }} |
    Select-Object Path, Owner