CVE-2024-53295: dell data_domain_operating_system

Vulnerability summary

CVE-2024-53295 is a high (CVSS 7.8) vulnerability in dell data_domain_operating_system. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 3.4% of scored vulnerabilities.

Timeline

1. 01-02-2025
   PublishedVulnerability first disclosed.
2. 04-02-2025
   Last modifiedVulnerability information updated.

Description

Dell PowerProtect DD versions prior to 8.3.0.0, 7.10.1.50, and 7.13.1.20 contain an improper access control vulnerability. A local malicious user with low privileges could potentially exploit this vulnerability leading to escalation of privilege.

• CWE-1220Insufficient Granularity of Access ControlThe product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.