← console
voxell vciy

CVE-2024-37140

ROUTINE

Telemetry drift only. No threshold crossed and no authority ruling changed.

CVE record, CISA KEV and EPSS as of 2026-10-18.

CVEs like this one computed, by meaning

What to do now held facts and links

  1. Upgrade to the fixed version for your release line, or later: 2.7.7; 5.16.0.0 CVE record
  2. Record your decision, dated and frozen with today's evidence: patch by a date · mitigated by a compensating control · deferred · accepted the risk · not affected
  3. Check your version against the ranges this record publishes.

What it is stated by the CNA

Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection vulnerability in an admin operation. A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the system application's underlying OS with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker.

weakness
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
affected
Dell PowerProtect DD
published ranges
dell data domain operating system < 7.7.5.40; dell data domain operating system >= 7.8.0.0 < 7.10.1.30; dell data domain operating system >= 7.11.0.0 < 7.13.1.0
fixed in
2.7.7; 5.16.0.0
severity
8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
assigned by
dell
published
2024-06-26

check us dell.com

Exploit code held, dated

exploit code
None held in the PoC-in-GitHub feed. A public repository changes this brief.

What moved held, dated

dateEPSSevent
26 Jun 20240.00043
24 Sep 20240.00052
17 Mar 20250.02304scoring model v2025.03.14
29 Mar 20250.06018
30 Mar 20250.02304
15 Apr 20250.01372
22 Apr 20250.01449
4 Aug 20250.06696
9 Aug 20250.05499
15 Nov 20250.07285
18 Nov 20250.02615
21 Nov 20250.07285
15 Jun 20260.01218scoring model v2026.06.15

13 observations held. A step marked with a scoring model moved because the measurement was replaced, not because the vulnerability changed.

Outside the record researched, cited

This section reads the record's references and adds cited findings from outside it. It needs an account. Everything above is held facts and is complete without it.

Sign in to add the researched section

What would change this brief held, dated

CISA KEV
Not listed in the catalogue we hold. A listing changes this brief.
exploit probability
0.01 on 2026-06-15 (FIRST's EPSS, a probability and not evidence of exploitation). Next band line: 10% (0.10). Crossing a line changes this brief.
fix
Held: 2.7.7; 5.16.0.0. A newer fix from the CNA or OSV changes this brief.

Watch this CVE What counts as a move

How to check this

Every value above is held with two dates: when it was true upstream (as_of) and when we recorded it (tx_from). Re-derive the exploit probability as it stood on any date:

SELECT value, source, source_version, as_of, tx_from
FROM volatile_valid_as_of('CVE-2024-37140', '2026-11-02T23:59:59.999999Z', now());