CVE-2024-37139 Denial of service in PowerProtect DD
A remote low-privileged attacker can cause temporary resource constraints leading to denial of service in Dell PowerProtect DD.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-37139?
CVE-2024-37139 is a medium-severity denial of service vulnerability in Dell Data Domain Operating System, published on 26 Jun 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an Improper Control of a Resource Through its Lifetime vulnerability in an admin operation. A remote low privileged attacker could potentially exploit this vulnerability, leading to temporary resource constraint of system application. Exploitation may lead to denial of service of the application.
Weakness: CWE-664
Which versions are affected by CVE-2024-37139?
It affects 1 product.
Products include Dell Data Domain Operating System.
How do I fix CVE-2024-37139?
No fix has been published for CVE-2024-37139 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-37139 being exploited?
There is no known exploitation of CVE-2024-37139 in the wild and no public exploit code.
Other vulnerabilities in Dell Data Domain Operating System
- CVE-2026-53481 Path traversal in PowerProtect Data Domain
- CVE-2026-53483 Auth bypass in PowerProtect Data Domain
- CVE-2025-36594 Auth bypass in PowerProtect Data Domain Feature Release
- CVE-2026-56086 Missing authorization in PowerProtect Data Domain
- CVE-2026-26944 Missing authorization in PowerProtect Data Domain
Sources
Also known as GHSA-554f-g6vm-mg6x.