CVE-2025-29987

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulnerability. An authenticated user from a trusted remote client could exploit this vulnerability to execute arbitrary commands with root privileges.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1220

Affected software

No affected versions have been published.

Timeline

Published
Apr 3, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-299886.7Dell Client Platform BIOS contains a Stack-based Buffer Overflow Vulnerability. A high privileged attacker with local access could potentialCVE-2025-299894.4Dell Client Platform BIOS contains a Security Version Number Mutable to Older Versions vulnerability. A high privileged attacker with local CVE-2025-29995.3A vulnerability was found in PyTorch 2.6.0. It has been rated as critical. Affected by this issue is the function torch.nn.utils.rnn.unpack_CVE-2025-299912.2Yubico YubiKey 5.4.1 through 5.7.3 before 5.7.4 has an incorrect FIDO CTAP PIN/UV Auth Protocol Two implementation. It uses the signature leCVE-2025-299927.5Mahara before 24.04.9 exposes database connection information if the database becomes unreachable, e.g., due to the database server being teCVE-2025-299935.3The affected versions of PowerCMS allow HTTP header injection. This vulnerability can be leveraged to direct the affected product to send emCVE-2025-299948.2This vulnerability exists in the CAP back office application due to improper authentication check at the API endpoint. An unauthenticated reCVE-2025-299958.3This vulnerability exists in the CAP back office application due to a weak password-reset mechanism implemented at API endpoints. An authentCVE-2025-299968.2This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based lCVE-2025-299978.2This vulnerability exists in the CAP back office application due to improper authorization checks on certain API endpoints. An authenticatedCVE-2025-299988.2This vulnerability exists in the CAP back office application due to missing rate limiting on OTP requests in an API endpoint. An authenticatCVE-2025-299996.7A vulnerability has been identified in Siemens License Server (SLS) (All versions < V4.3). The affected application searches for executable