CVE-2025-36568
Insufficiently Protected Credentials in Dell PowerProtect BoostFS
Publication date: 2026-04-17
Last updated on: 2026-04-20
Assigner: Dell
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dell | data_domain_operating_system | From 8.4.0.0 (inc) to 8.6.0.0 (exc) |
| dell | data_domain_operating_system | From 7.14.0.0 (inc) to 8.3.1.30 (exc) |
| dell | data_domain_operating_system | From 7.7.1.0 (inc) to 7.13.1.60 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-522 | The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Dell PowerProtect Data Domain BoostFS client versions 7.7.1.0 through 8.5, and certain LTS2025 and LTS2024 release versions. It is caused by insufficient protection of credentials stored by the software.
A low privileged attacker who has local access to the system could exploit this vulnerability to expose these credentials.
Once the credentials are exposed, the attacker may use them to gain access to the system with the privileges of the compromised account.
How can this vulnerability impact me? :
The impact of this vulnerability includes potential unauthorized access to the system by an attacker who initially has only low privileges and local access.
By exploiting the exposed credentials, the attacker could escalate privileges and perform actions with the compromised account's permissions.
This could lead to confidentiality, integrity, and availability breaches, as indicated by the CVSS score which rates the impact on confidentiality, integrity, and availability as high.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves insufficiently protected credentials that could be exposed by a low privileged attacker with local access, potentially allowing unauthorized access to the system with the privileges of the compromised account.
Such credential exposure and unauthorized access could lead to violations of common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and access controls to prevent unauthorized disclosure or modification.
Therefore, exploitation of this vulnerability may impact compliance by increasing the risk of data breaches and unauthorized access to protected information.