CVE-2025-43905: Dell Data Domain OS DoS Vulnerability

CVE-2025-43905 Overview

CVE-2025-43905 is an argument injection vulnerability in Dell PowerProtect Data Domain running Data Domain Operating System (DD OS). The flaw is classified under [CWE-88] Improper Neutralization of Argument Delimiters in a Command. A low-privileged remote attacker can exploit this weakness to trigger a denial-of-service condition against the appliance. The vulnerability affects Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release 8.3.1.0, LTS2024 releases 7.13.1.0 through 7.13.1.30, and LTS2023 releases 7.10.1.0 through 7.10.1.60. Dell addressed the issue in security advisory DSA-2025-333.

Critical Impact
Authenticated remote attackers can disrupt Dell PowerProtect Data Domain availability, potentially interrupting backup, restore, and replication operations across protected workloads.

Affected Products

Dell PowerProtect Data Domain with DD OS Feature Release versions 7.7.1.0 through 8.3.0.15
Dell PowerProtect Data Domain with DD OS LTS2025 release 8.3.1.0 and LTS2024 releases 7.13.1.0 through 7.13.1.30
Dell PowerProtect Data Domain with DD OS LTS2023 releases 7.10.1.0 through 7.10.1.60

Discovery Timeline

2025-10-07 - CVE-2025-43905 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43905

Vulnerability Analysis

The vulnerability originates in a command-processing path within DD OS that accepts user-supplied input and forwards it to an underlying command invocation. The system fails to neutralize argument delimiters before constructing the command line. An attacker with valid low-privilege credentials can supply crafted arguments that alter the behavior of the invoked command. The resulting behavior causes the target process or service to terminate or become unresponsive, degrading appliance availability.

Dell PowerProtect Data Domain provides deduplication storage for enterprise backup and disaster recovery. Loss of availability on these systems affects the ability to complete scheduled backups, recover data, and replicate to secondary sites. The attack does not require user interaction and can be executed remotely over the network once the attacker holds valid credentials.

Root Cause

The root cause is improper neutralization of argument delimiters in a command, cataloged as [CWE-88]. DD OS constructs a command line using attacker-influenced tokens without stripping or escaping characters that the target program interprets as separate arguments or option flags. This gap allows attacker-supplied strings to be reinterpreted as command switches that produce unintended runtime behavior.

Attack Vector

Exploitation requires network access to the DD OS management interface and valid low-privilege credentials. The attacker submits crafted input to a vulnerable command endpoint. The malformed arguments propagate into the internal command construction, triggering a fault condition that consumes resources or terminates the service. No verified public proof-of-concept code is available at the time of writing. Refer to the Dell Security Update DSA-2025-333 for vendor-authoritative technical details.

Detection Methods for CVE-2025-43905

Indicators of Compromise

Unexpected termination or restart of DD OS services or management daemons without a corresponding administrative action.
Repeated command submissions from a single authenticated session containing unusual delimiter characters such as -, --, spaces, or shell metacharacters in argument fields.
Sudden interruption of backup, restore, or replication jobs correlated with authenticated management activity.

Detection Strategies

Enable and forward DD OS audit and CLI logs to a centralized log platform for correlation of command inputs with service faults.
Alert on authentication events from low-privileged Data Domain accounts followed by service crash or restart events within a short time window.
Baseline expected command usage per account and flag deviations that include suspicious argument patterns.

Monitoring Recommendations

Monitor system health metrics such as service uptime, CPU, and memory on Data Domain appliances for anomalies following authenticated sessions.
Track failed and successful management logins from unexpected source IP ranges or outside change windows.
Review Dell support alerts and DD OS event notifications regularly for indicators of instability associated with DSA-2025-333.

How to Mitigate CVE-2025-43905

Immediate Actions Required

Apply the fixed DD OS releases listed in Dell Security Update DSA-2025-333 as soon as maintenance windows permit.
Inventory all Dell PowerProtect Data Domain systems and confirm the running DD OS version against the affected ranges.
Rotate credentials for any low-privileged Data Domain accounts and enforce strong, unique passwords.

Patch Information

Dell has released fixed DD OS versions addressing CVE-2025-43905. Customers should consult the Dell Security Update DSA-2025-333 advisory for specific fixed version numbers across the Feature Release, LTS2025, LTS2024, and LTS2023 branches. Follow Dell's standard DD OS upgrade guidance and validate backup integrity after applying updates.

Workarounds

Restrict network access to the DD OS management interface using firewall rules or management VLAN isolation so only trusted administrative hosts can reach it.
Limit account provisioning on DD OS to the minimum number of users required and audit existing low-privileged accounts.
Enforce multi-factor authentication and session logging on jump hosts used to administer Data Domain appliances.

bash

# Example: restrict access to Data Domain management interface using host firewall
# Replace <admin_subnet> and <dd_mgmt_ip> with your environment values
iptables -A INPUT -p tcp -s <admin_subnet> -d <dd_mgmt_ip> --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -d <dd_mgmt_ip> --dport 22 -j DROP