CVE-2026-35073

MediumCVSS 6.7/10Last modified Oct 26, 2026

Description

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
DellPowerProtect Data Domain< 8.7.0.1 or later; < 8.3.1.30 or later; < 7.13.1.70 or later

References

Timeline

Published
Apr 17, 2026
Last modified
Oct 26, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-350746.7Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2CVE-2026-350759.8An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affecteCVE-2026-350768.1The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of usCVE-2026-350778.1The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of CVE-2026-350788.1The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of userCVE-2026-350798.1The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-CVE-2026-35086.8An Out-of-bounds Read vulnerability in the IOCTL handler in ASUS System Control Interface allows a local user to cause system crash (BSOD) vCVE-2026-350808.1The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of uCVE-2026-350818.1The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of userCVE-2026-350828.8The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-CVE-2026-350838.8A remote attacker with user privileges can exploit a stack buffer overflow to gain full system access as root.CVE-2026-350848.8A remote attacker with user privileges can exploit a stack buffer overflow in dali-devconfig to gain full system access as root.
CVE-2026-35073: Medium severity, CVSS 6.7 | Vulnix