CVE-2023-48667

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-14 · updated 2026-06-17
Weakness: CWE-78

Description

Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in administrator CLI. A remote high privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS to bypass security restriction. Exploitation may lead to a system take over by an attacker.

Affected products

Dell Apex Protection Storage: before 6.2.1.110; from 7.0 before 7.10.1.15 — fixed in 6.2.1.110, 7.10.1.15
EMC Data Domain OS 5.2 through 5.7 before 5.7.3.0 and 6.0 before 6.0.1.0: before 6.2.1.110; from 7.0 before 7.12.0.0; from 7.7 before 7.7.5.25; from 7.10 before 7.10.1.15 — fixed in 6.2.1.110, 7.10.1.15, 7.12.0.0, 7.7.5.25
Dell Powerprotect Data Domain: before 6.2.1.110; from 7.0 before 7.12.0.0 — fixed in 6.2.1.110, 7.12.0.0
Dell PowerProtect DD: before 6.2.1.110; from 7.0 before 7.13.0.10; from 7.7 before 7.7.5.25; from 7.10 before 7.10.1.15 — fixed in 6.2.1.110, 7.10.1.15, 7.13.0.10, 7.7.5.25
Dell Powerprotect Data Protection: before 2.7.6 — fixed in 2.7.6

How to fix

Upgrade to a fixed version: Dell Apex Protection Storage 6.2.1.110, 7.10.1.15; EMC Data Domain OS 5.2 through 5.7 before 5.7.3.0 and 6.0 before 6.0.1.0 6.2.1.110, 7.10.1.15, 7.12.0.0, 7.7.5.25; Dell Powerprotect Data Domain 6.2.1.110, 7.12.0.0; Dell PowerProtect DD 6.2.1.110, 7.10.1.15, 7.13.0.10, 7.7.5.25; Dell Powerprotect Data Protection 2.7.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-48667 or the next vulnerability affects your stack