CVE-2025-43907: Dell Data Domain OS Path Traversal Flaw

CVE-2025-43907 Overview

Dell PowerProtect Data Domain contains a path traversal vulnerability in the Data Domain Operating System (DD OS). The flaw affects Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release 8.3.1.0, LTS2024 releases 7.13.1.0 through 7.13.1.30, and LTS2023 releases 7.10.1.0 through 7.10.1.60. An authenticated attacker with low privileges and network access can exploit the flaw using a .../...// sequence to traverse directories outside the intended path. Successful exploitation leads to information exposure on the target appliance. Dell assigned this issue CWE-35: Path Traversal and published remediation guidance in advisory DSA-2025-333.

Critical Impact
A remote, low-privileged attacker can read sensitive files stored on Dell PowerProtect Data Domain appliances, exposing backup metadata and system configuration data.

Affected Products

Dell Data Domain Operating System Feature Release versions 7.7.1.0 through 8.3.0.15
Dell Data Domain Operating System LTS2025 version 8.3.1.0 and LTS2024 versions 7.13.1.0 through 7.13.1.30
Dell Data Domain Operating System LTS2023 versions 7.10.1.0 through 7.10.1.60

Discovery Timeline

2025-10-07 - CVE CVE-2025-43907 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43907

Vulnerability Analysis

The vulnerability is a path traversal weakness classified under CWE-35. Dell's advisory identifies the specific traversal pattern as .../...//, an obfuscation technique that bypasses naive filters stripping ../ sequences. When a sanitizer removes a single ../ from .../...//, the remaining characters collapse into a valid ../ sequence and escape the intended directory.

The issue affects Data Domain Operating System, the platform running Dell PowerProtect Data Domain backup appliances. These systems store enterprise backup images, snapshots, and replication metadata, making unauthorized file reads a direct threat to backup integrity assumptions.

An attacker exploits the flaw across the network with valid low-privilege credentials and no user interaction. Successful exploitation grants read access to files outside the permitted directory scope, resulting in information disclosure without impacting integrity or availability.

Root Cause

The root cause is insufficient normalization of user-supplied path input in a request handler within DD OS. The sanitization logic fails to recursively resolve traversal sequences, allowing the .../...// pattern to survive input filtering and reach the underlying file system API.

Attack Vector

Exploitation requires network access to a DD OS management or service interface and an authenticated account with low privileges. The attacker submits a crafted request containing the .../...// sequence in a path parameter. The server resolves the manipulated path and returns file contents from outside the expected directory. No verified proof-of-concept exploit is publicly available.

// Vulnerability described in prose only; no verified exploit code is public.
// Reference: Dell Security Advisory DSA-2025-333

Detection Methods for CVE-2025-43907

Indicators of Compromise

Requests to DD OS management interfaces containing the literal sequence .../...// or URL-encoded variants such as %2E%2E%2E%2F%2E%2E%2E%2F%2F.
Access log entries showing successful HTTP responses to path parameters referencing sensitive locations like /etc/, /ddr/var/, or system configuration directories.
Authenticated sessions from low-privileged accounts issuing unusual file-retrieval requests outside their normal workflow.

Detection Strategies

Inspect DD OS audit and web access logs for path parameters containing dot-slash obfuscation patterns, including nested and mixed-encoding forms.
Deploy web application firewall or reverse proxy rules that decode input recursively before matching traversal signatures.
Correlate low-privileged account activity with file-access telemetry to surface reads targeting files outside the account's role scope.

Monitoring Recommendations

Forward DD OS syslog and audit records to a centralized log platform with alerting on traversal signatures and anomalous file reads.
Track authentication events on Data Domain appliances and flag sessions originating from unexpected source networks.
Baseline normal API and management-interface access patterns per account, then alert on deviations in request paths or data volumes.

How to Mitigate CVE-2025-43907

Immediate Actions Required

Apply the fixed DD OS release listed in Dell Security Advisory DSA-2025-333 to all affected appliances.
Restrict network access to Data Domain management interfaces to a dedicated administrative network or jump host.
Audit local and remote DD OS accounts, remove unused low-privileged accounts, and rotate credentials for any account with recent unusual activity.

Patch Information

Dell published fixed builds in advisory DSA-2025-333 covering the Feature Release, LTS2025, LTS2024, and LTS2023 branches. Administrators should upgrade to a version above the affected ranges: beyond 8.3.0.15 on Feature Release, beyond 8.3.1.0 on LTS2025, beyond 7.13.1.30 on LTS2024, and beyond 7.10.1.60 on LTS2023. Confirm the exact fixed version in the vendor advisory before scheduling maintenance.

Workarounds

Place Data Domain management interfaces behind a firewall or VPN that limits access to trusted administrator IP ranges.
Configure a reverse proxy or WAF in front of the appliance to block requests containing .../...// and equivalent encoded sequences until patching completes.
Reduce the number of low-privileged remote accounts and enforce multi-factor authentication where supported to raise the exploitation barrier.

bash

# Example WAF rule concept (adapt to your platform) to block the traversal pattern
# Deny requests where the decoded URI contains the '.../...//' obfuscation
SecRule REQUEST_URI "@rx \.\.\./\.\.\.//" \
  "id:1004390,phase:1,deny,status:403,log,msg:'DD OS path traversal attempt (CVE-2025-43907)'"