Dell PowerProtect BoostFS
CVE-2025-43914
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Impact | This is a credible but non-urgent local privilege escalation issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) is internally consistent with the description: an attacker needs local access and existing low-level privileges (PR:L), exploitation is low-complexity (AC:L), and successful exploitation yields full confidentiality, integrity, and availability impact on the affected host - characteristic of a CWE-266 Incorrect Privilege Assignment leading to escalation. The real-world exploitation signals are uniformly low: EPSS is 0.10% (1st percentile), the CVE is NOT on the CISA KEV list, and no public exploit code has been identified. These low-threat signals align with the high CVSS, which is driven by impact rather than by ease or likelihood of remote exploitation - the 'High' severity reflects consequence, not imminent danger. Note a tagging conflict: the input Tags label this 'Authentication Bypass,' but the description and CWE-266 describe a local privilege-escalation / incorrect-privilege-assignment flaw requiring pre-existing low-privileged access, NOT an authentication bypass - the tag appears mislabeled and should not drive prioritization. Bottom line: a legitimate patch-worthy issue for exposure-reduction, but not an emergency; prioritize below any internet-facing or actively-exploited findings. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
Incorrect privilege assignment in Dell PowerProtect BoostFS for Linux Ubuntu lets a local low-privileged user obtain unauthorized elevated access on affected Data Domain deployments, including Feature Release 7.7.1.0 through 8.3.0.15, LTS2025 8.3.1.0, LTS2024 7.13.1.0 through 7.13.1.30, and LTS2023 7.10.1.0 through 7.10.1.60. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) requires local access and low privileges but yields high confidentiality, integrity, and availability impact; EPSS is only 0.10% (1st percentile), no public exploit code or CISA KEV entry was identified, so this is a credible but non-urgent local privilege escalation issue.
RemediationAI
Dell advisory DSA-2025-333 is a security update for these multiple vulnerabilities, so a vendor-released patch is available per the advisory; the input does not provide an exact fixed version, so use the advisory's version matrix rather than assuming a release number. Until the update can be staged, reduce exposure by restricting local shell and console access on Ubuntu hosts running BoostFS to trusted administrators, removing unnecessary local accounts, and auditing file ownership, permissions, and setuid/setgid or file-capability settings on BoostFS installation and mount directories so low-privileged users cannot exploit the misassigned privileges; these controls trade some operational convenience for reduced local attack surface but do not replace patching. Monitor Dell's advisory for updated fixed versions and any vendor workarounds.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
BoostFS is Dell PowerProtect Data Domain's client-side file system for Linux, allowing hosts to mount and access Data Domain storage over the network for backup and archive workflows; the affected builds run on Ubuntu. The root cause is CWE-266 (Incorrect Privilege Assignment), meaning the software grants an actor privileges or permissions that do not match its intended trust level, so a local low-privileged user can leverage misassigned privileges to escalate access. The CVSS vector confirms the attack is local (AV:L), requires low privileges (PR:L), needs no user interaction (UI:N), and has high impact across confidentiality, integrity, and availability, while the supplied CPE maps to Dell Data Domain Operating System; the vendor advisory should be treated as authoritative for the exact BoostFS package scope.
Know when Data Domain Operating System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionNVD
Dell PowerProtect Data Domain BoostFS for Linux Ubuntu systems of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.
Executive ViewAI
Dell PowerProtect BoostFS for Linux Ubuntu contains a local privilege-assignment flaw that could let a low-privileged user gain elevated access on affected Data Domain deployments, threatening the confidentiality, integrity, and availability of backup data. The issue affects specific Feature Release, LTS2025, LTS2024, and LTS2023 versions and requires local access; no public exploit identified at time of analysis, so immediate external exploitation is not indicated. Leadership should care because backup infrastructure compromise can disrupt recovery and expose sensitive data, even when exploitation is constrained to local users.
No vendor-released patch identified at time of analysis; restrict local interactive and sudo access on Ubuntu BoostFS hosts, remove unnecessary BoostFS installations, enforce least privilege and unique admin accounts, monitor for local privilege escalation and backup-data access anomalies, and isolate affected Data Domain deployments from untrusted networks until a vendor fix is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)NVD
More in Data Domain Operating System
View allDell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficie
Improper authorization enforcement in Dell PowerProtect Data Domain (versions 7.7.1.0 through 8.6, plus LTS branches 8.6
Missing authentication in Dell PowerProtect Data Domain 7.7.1.0-8.6 and LTS releases allows remote unauthenticated attac
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection v
Dell PowerProtect DD, version(s) 8.0, 7.13.1.0, 7.10.1.30, 7.7.5.40, contain(s) an Out-of-bounds Write vulnerability. Ra
An unauthenticated path traversal flaw in the web management UI of Dell PowerProtect Data Domain (DD OS) lets remote att
Unauthenticated remote attackers can exploit an incorrect authentication-algorithm implementation in the Dell PowerProte
Denial of service in Dell PowerProtect Data Domain (DDOS versions 7.7.1.0 through 8.7, plus LTS2026 8.6.1.0-8.6.1.10, LT
Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of
OS command injection in Dell PowerProtect Data Domain allows remote high-privileged attackers to execute arbitrary comma
Dell PowerProtect DD, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an access control vulnerab
Stored cross-site scripting in Dell PowerProtect Data Domain (DD OS 7.7.1.0 through 8.7, plus the LTS2026 8.6.1.x, LTS20
GitHub PoC
Exploit-DB