EUVD-2026-23392
GHSA-w42r-7hmw-4854
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H
Lifecycle Timeline
8DescriptionCVE.org
Dell PowerProtect Data Domain appliances with Data Domain Operating System (DD OS) of Feature Release versions 8.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.10 contain an insertion of sensitive information into log file vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to credential exposures. Authentication attempts as the compromised user would need to be authorized by a high privileged DD user. This vulnerability only affects systems with retention lock enabled.
AnalysisAI
Dell PowerProtect Data Domain appliances log sensitive credentials when retention lock is enabled, allowing low-privileged remote attackers to harvest authentication data from log files. Affects DD OS 8.0-8.5 and LTS2025 8.3.1.0-8.3.1.10. Exploitation requires existing low-privileged access plus user interaction from a high-privileged administrator to authorize subsequent authentication attempts. EPSS score of 0.01% and SSVC assessment (non-automatable, partial impact) indicate low probability of widespread exploitation. Vendor patch available per Dell DSA-2026-060.
Technical ContextAI
This vulnerability stems from CWE-532 (Insertion of Sensitive Information Into Log File), a common logging implementation flaw where applications inadvertently record credentials, tokens, or other secrets in plaintext logs. Dell PowerProtect Data Domain is an enterprise backup and recovery appliance running DD OS (Data Domain Operating System). The affected component appears to be the authentication subsystem's logging mechanism when the retention lock feature-a compliance-oriented capability that prevents premature deletion of backup data-is enabled. The flaw specifically impacts Feature Release versions 8.0 through 8.5 and Long-Term Support 2025 versions 8.3.1.0 through 8.3.1.10, as identified by CPE cpe:2.3:a:dell:powerprotect_data_domain_appliances. The CVSS vector AV:N/AC:L indicates network-accessible exploitation with low complexity, but PR:L/UI:R constraints require an authenticated low-privileged attacker and victim user interaction from a high-privileged administrator.
RemediationAI
Apply vendor-released patches immediately for affected systems with retention lock enabled. Upgrade Feature Release installations to DD OS version 8.6.0.0 or later, or upgrade LTS2025 installations to DD OS version 8.3.1.20 or later, following procedures in Dell DSA-2026-060 at https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities. If immediate patching is not feasible, implement compensating controls: (1) disable retention lock feature if not required for compliance obligations (note this removes data immutability protections and may violate regulatory requirements), (2) restrict network access to DD OS management interfaces using firewall rules permitting only trusted administrator networks (reduces attack surface but does not eliminate risk from insider threats), (3) enable enhanced audit logging and monitor for unusual log file access patterns by low-privileged accounts, and (4) implement principle of least privilege by reviewing and reducing low-privileged account permissions to management interfaces. Review historical log files on affected systems for evidence of credential exposure and rotate credentials for any high-privileged accounts that authenticated during the vulnerable period.
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection
d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote at
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today