Executive Summary

This vulnerability affects Dell PowerProtect Data Domain appliances running certain versions of the Data Domain Operating System (DD OS). It involves the insertion of sensitive information into log files. A low privileged attacker with remote access could exploit this issue to expose credentials. However, any authentication attempts using the compromised credentials would still require authorization by a high privileged DD user. The vulnerability only impacts systems that have the retention lock feature enabled.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to exposure of sensitive credentials through log files, which could be accessed by a low privileged remote attacker. This exposure increases the risk of unauthorized access attempts. Although further authentication requires high privileged user authorization, the initial credential exposure could facilitate targeted attacks or privilege escalation attempts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability involves the insertion of sensitive information into log files, which could lead to credential exposures if exploited by a low privileged attacker with remote access.

Such exposure of sensitive information may impact compliance with data protection standards and regulations like GDPR and HIPAA, which require the protection of sensitive data and credentials to prevent unauthorized access.

However, the vulnerability only affects systems with retention lock enabled and requires authentication attempts to be authorized by a high privileged user, which may limit the scope of impact.

Useful 0 Not Useful 0

Mitigation Strategies

This vulnerability affects Dell PowerProtect Data Domain appliances with retention lock enabled. Immediate mitigation steps include verifying if retention lock is enabled on your system and restricting remote access to low privileged users to prevent exploitation.

Additionally, ensure that authentication attempts as the compromised user require authorization by a high privileged DD user, and consider applying any available patches or updates from Dell for the affected DD OS versions 8.0 through 8.5 and LTS2025 release versions 8.3.1.0 through 8.3.1.10.

Useful 0 Not Useful 0