Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HSummary
CVE-2024-51534 is a high-severity Path Traversal: '\..\filename' (CWE-29) vulnerability in Dell Data Domain Operating System. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-51534 is a path traversal vulnerability (CWE-22, CWE-29) affecting Dell PowerProtect DD systems running versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.20. It enables a local low-privileged user to potentially overwrite operating system files on the server filesystem. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), indicating high impact on integrity and availability with no confidentiality impact.
A low-privileged local user can exploit this vulnerability to perform unauthorized overwrites of OS files, potentially leading to denial of service conditions on the affected PowerProtect DD system. The attack requires local access and low privileges, with low complexity and no user interaction needed.
Dell's security advisory DSA-2025-022, detailed at https://www.dell.com/support/kbdoc/en-us/000279157/dsa-2025-022-security-update-for-dell-powerprotect-dd-multiple-vulnerabilities, addresses this and other vulnerabilities in PowerProtect DD with a security update. Practitioners should apply patches to reach or exceed the fixed versions (DDOS 8.3.0.0, 7.10.1.50, or 7.13.1.20) to mitigate the issue.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-45806
Vulnerability Data
Dell PowerProtect DD versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.20 contain a path traversal vulnerability. A local low privileged could potentially exploit this vulnerability to gain unauthorized overwrite of OS files stored on the server filesystem. Exploitation could lead…
more
to denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2
Mitigating Controls (NIST 800-53 r5) AI
Enforces the intended directory access authorizations that path traversal would otherwise bypass.
Input validation directly neutralizes the '\..\filename' sequence before pathname resolution occurs.
Least privilege reduces the impact of any unauthorized file access obtained via traversal.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and path sanitization that block this traversal vector.
Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.
PR.AA-05 defines and reviews access policies but does not address code-level pathname neutralization, so neither direction prevents CWE-22.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can discover path-traversal flaws but does not itself prevent them in production code.
Secure SDLC mandates input validation and path sanitization that directly prevent path traversal.
Application security requirements can mandate input validation and path canonicalization to block traversal sequences.
Secure architecture principles include directory sandboxing and safe file-access design that mitigate path traversal.
Secure coding standards directly require neutralizing path traversal sequences such as '\..\filename'.
Information access restriction limits which files an application may read or write.