CVE-2025-36594
Last modified
CVE-2025-36594 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Authentication Bypass by Spoofing vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. EPSS estimates a 0.45% chance of exploitation in the next 30 days.
Description
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Authentication Bypass by Spoofing vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Remote unauthenticated user can create account that potentially expose customer info, affect system integrity and availability.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dell | Data Domain Operating System | >= 7.7.1.0, < 7.10.1.70 |
| Dell | Data Domain Operating System | >= 7.13.1.0, < 7.13.1.30 |
| Dell | Data Domain Operating System | >= 8.0.0.0, < 8.3.1.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-36594?
How severe is CVE-2025-36594?
How do I fix CVE-2025-36594?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-36582Dell NetWorker, versions 19.12.0.1 and prior, contains a Sel…7.5
- CVE-2025-36588Dell Unisphere for PowerMax, version(s) 10.2.0.x, contain(s)…8.8
- CVE-2025-36589Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) …7.1
- CVE-2025-3659Improper authentication handling was identified in a set of …9.4
- CVE-2025-36592Dell Secure Connect Gateway (SCG) Policy Manager, version(s)…5.4
- CVE-2025-36593Dell OpenManage Network Integration, versions prior to 3.8, …8.8
- CVE-2025-36595Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contai…7.2
- CVE-2025-36597Dell Avamar, versions prior to 19.12 with patch 338905, cont…4.7
- CVE-2025-36598Dell Avamar, versions prior to 19.12 with patch 338905, cont…6.5
- CVE-2025-36599Dell PowerFlex Manager VM, versions prior to 4.6.2.1, contai…6.5
- CVE-2025-3660Petlibro Smart Pet Feeder Platform versions up to 1.7.31 con…8.2
- CVE-2025-36600Dell Client Platform BIOS contains an Improper Access Contro…8.2
Are you affected by CVE-2025-36594?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST