CVE-2016-8216 Command injection in EMC Data Domain DD OS EMC Data Domain OS (DD OS) 5.4 all versions, EMC Data Domain OS (DD OS) 5.5 family all versions prior to 5.5.5.0, EMC Data Domain OS (DD OS) 5.6 family all versions prior to 5.6.2.0, EMC Data Domain OS (DD OS) 5.7 family all versions prior to 5.7.2.10

What is CVE-2016-8216?

CVE-2016-8216 is a medium-severity command injection vulnerability in EMC Data Domain DD OS EMC Data Domain OS (DD OS) 5.4 all versions, EMC Data Domain OS (DD OS) 5.5 family all versions prior to 5.5.5.0, EMC Data Domain OS (DD OS) 5.6 family all versions prior to 5.6.2.0, EMC Data Domain OS (DD OS) 5.7 family all versions prior to 5.7.2.10, published on 3 Feb 2017. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

EMC Data Domain OS (DD OS) 5.4 all versions, EMC Data Domain OS (DD OS) 5.5 family all versions prior to 5.5.5.0, EMC Data Domain OS (DD OS) 5.6 family all versions prior to 5.6.2.0, EMC Data Domain OS (DD OS) 5.7 family all versions prior to 5.7.2.10 has a command injection vulnerability that could potentially be exploited by malicious users to compromise the affected system.

Weakness: CWE-264

Which versions are affected by CVE-2016-8216?

It affects 1 product.

Products include Dell Emc Data Domain Os.

How do I fix CVE-2016-8216?

No fix has been published for CVE-2016-8216 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2016-8216 being exploited?

There is no known exploitation of CVE-2016-8216 in the wild and no public exploit code.

Other vulnerabilities in EMC Data Domain DD OS EMC Data Domain OS (DD OS) 5.4 all versions, EMC Data Domain OS (DD OS) 5.5 family all versions prior to 5.5.5.0, EMC Data Domain OS (DD OS) 5.6 family all versions prior to 5.6.2.0, EMC Data Domain OS (DD OS) 5.7 family all versions prior to 5.7.2.10

• CVE-2016-0912 Security feature bypass in n/a Critical 9.8
• CVE-2023-23692 Command injection in Data Domain High 8.8
• CVE-2016-0911 Misconfiguration in n/a High 8.2
• CVE-2017-4983 Privilege escalation in EMC Data Domain OS 5.2 through 5.7 before 5.7.3.0 and 6.0 before 6.0.1.0 Medium 6.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vj3f-jxv4-qrgv.