Introduction
CVE-2025-43727 lets attackers remotely bypass authentication and reach critical backup infrastructure in some of the world's largest enterprise environments. The high-severity flaw is in Dell PowerProtect Data Domain systems, which are widely used for enterprise data protection and disaster recovery. It affects multiple versions of the Data Domain Operating System (DD OS), so a broad range of organizations are exposed to unauthorized access to sensitive backup data and management interfaces.
Dell Technologies is a global leader in enterprise IT infrastructure, and PowerProtect Data Domain is its flagship product for scalable, deduplicated backup and data protection. The platform is deployed in thousands of organizations across critical sectors, so a flaw in its authentication puts enterprise data at risk worldwide.
Technical Information
CVE-2025-43727 comes from authentication algorithms that are implemented incorrectly in the RestAPI component of the Dell PowerProtect Data Domain Operating System. It is classified as CWE-303, the category for incorrectly implemented authentication algorithms that let attackers bypass intended security controls.
The vulnerability affects the following DD OS versions:
- Feature Release: 7.7.1.0 through 8.1.0.10
- LTS2024: 7.13.1.0 through 7.13.1.25
- LTS2023: 7.10.1.0 through 7.10.1.50
The RestAPI handles management and automation tasks on Data Domain systems. Because its authentication logic is flawed, an unauthenticated attacker with network access can send crafted API requests that get past the authentication checks. The attacker needs no valid credentials and no user interaction, which raises the risk to affected systems considerably. The root cause is a failure in how the RestAPI validates authentication tokens or credentials. That failure opens sensitive management functions to unauthorized access, and potentially the backup data itself. No public code snippets or proof-of-concept exploits are available for this vulnerability.
Patch Information
Dell Technologies has released security updates that fix multiple vulnerabilities in the PowerProtect Data Domain Operating System (DD OS). To mitigate them, upgrade promptly to the remediated versions below:
- DD OS 8.3: Upgrade to version 8.3.0.10 or later.
- DD OS 7.13.1: Upgrade to version 7.13.1.30 or later.
- DD OS 7.10.1: Upgrade to version 7.10.1.60 or later.
The updates cover vulnerabilities in a range of components, including iDRAC9, Velocity, container-suseconnect, CUPS, Curl, expat, Glib2, Kernel, OpenSSL, and libpcap.
Dell's official upgrade instructions are in Data Domain and DDVE: How to Upgrade the Data Domain Operating System. Check the Data Domain Compatibility Matrix to confirm that your system is compatible with the new DD OS versions.
Affected Systems and Versions
CVE-2025-43727 affects the following Dell PowerProtect Data Domain Operating System versions:
- Feature Release versions 7.7.1.0 through 8.1.0.10
- LTS2024 release versions 7.13.1.0 through 7.13.1.25
- LTS2023 release versions 7.10.1.0 through 7.10.1.50
Any system running these versions with the RestAPI component enabled is vulnerable. Default and custom configurations are both affected if the vulnerable RestAPI is reachable over the network.
Vendor Security History
Dell Technologies has fixed similar authentication and access control vulnerabilities in its storage and backup products before. Dell typically issues coordinated advisories and patches, as it did with DSA-2025-159. It generally patches critical vulnerabilities promptly and maintains a mature security advisory process for its enterprise products.
