CVE-2026-23775
Sensitive Data Exposure via Log Injection in Dell PowerProtect DD OS
Publication date: 2026-04-17
Last updated on: 2026-04-20
Assigner: Dell
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dell | data_domain_operating_system | From 8.4.0.0 (inc) to 8.6.0.0 (exc) |
| dell | data_domain_operating_system | From 8.3.0.0 (inc) to 8.3.1.20 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Dell PowerProtect Data Domain appliances running certain versions of the Data Domain Operating System (DD OS). It involves the insertion of sensitive information into log files. A low privileged attacker with remote access could exploit this issue to expose credentials. However, any authentication attempts using the compromised credentials would still require authorization by a high privileged DD user. The vulnerability only impacts systems that have the retention lock feature enabled.
How can this vulnerability impact me? :
The vulnerability can lead to exposure of sensitive credentials through log files, which could be accessed by a low privileged remote attacker. This exposure increases the risk of unauthorized access attempts. Although further authentication requires high privileged user authorization, the initial credential exposure could facilitate targeted attacks or privilege escalation attempts.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves the insertion of sensitive information into log files, which could lead to credential exposures if exploited by a low privileged attacker with remote access.
Such exposure of sensitive information may impact compliance with data protection standards and regulations like GDPR and HIPAA, which require the protection of sensitive data and credentials to prevent unauthorized access.
However, the vulnerability only affects systems with retention lock enabled and requires authentication attempts to be authorized by a high privileged user, which may limit the scope of impact.
What immediate steps should I take to mitigate this vulnerability?
This vulnerability affects Dell PowerProtect Data Domain appliances with retention lock enabled. Immediate mitigation steps include verifying if retention lock is enabled on your system and restricting remote access to low privileged users to prevent exploitation.
Additionally, ensure that authentication attempts as the compromised user require authorization by a high privileged DD user, and consider applying any available patches or updates from Dell for the affected DD OS versions 8.0 through 8.5 and LTS2025 release versions 8.3.1.0 through 8.3.1.10.