Dell PowerProtect Data Manager Flaw Allows System Compromise by Attackers

Dell has released a critical security update for its PowerProtect Data Manager (PPDM) platform to address multiple vulnerabilities that could allow attackers to compromise systems and execute arbitrary commands, with the advisory DSA-2025-326 naming the issues.

The flaws affect PPDM versions 19.19 and 19.20 and centre on the Hyper-V component, including two high-severity command injection CVEs, CVE-2025-43884 (CVSS 8.2) requiring high-privileged local access and CVE-2025-43885 (CVSS 7.8) needing only low-privileged access. Another concern is CVE-2025-43888 (CVSS 8.8), which could let low-privileged attackers with local access read into log files to gain unauthorized data, also tied to Hyper-V.

Additional risks include CVE-2025-43725 (CVSS 7.8) affecting the Generic Application Agent, CVE-2025-43887 (CVSS 7.0) for elevation of privileges, a plaintext password storage flaw (CVSS 5.0), and CVE-2025-43886 (CVSS 4.4) a path traversal vulnerability.

Beyond PPDM’s code, the update patches multiple third‑party components, including Apache Tomcat, Spring Framework, Java OpenJDK, and various libraries, with Dell urging immediate upgrade to PowerProtect Data Manager version 19.21 build 11 or later to mitigate the risk of complete system compromise.