EUVD-2026-23378Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
8DescriptionCVE.org
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain a use of weak credentials vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to unauthorized access to the system.
AnalysisAI
Local attackers can gain full system access to Dell PowerProtect Data Domain storage systems without authentication due to weak default credentials in DD OS versions 7.7.1.0-8.5, 8.3.1.0-8.3.1.20, and 7.13.1.0-7.13.1.50. The vulnerability allows complete system compromise (CVSS 8.4) with high confidentiality, integrity, and availability impact despite requiring local access. No active exploitation confirmed (EPSS 0.01%, not in CISA KEV), and Dell has released patches across all affected release branches. SSVC framework rates this as total technical impact but non-automatable and not currently exploited.
Technical ContextAI
Dell PowerProtect Data Domain is an enterprise backup and recovery storage appliance running DD OS (Data Domain Operating System). This vulnerability stems from CWE-1391 (Use of Weak Credentials), indicating the system ships with or permits easily guessable credentials that can be leveraged for unauthorized access. The weakness affects multiple release branches: Feature Release (7.7.1.0-8.5), LTS2025 (8.3.1.0-8.3.1.20), and LTS2024 (7.13.1.0-7.13.1.50). The local attack vector (AV:L) with no privileges required (PR:N) suggests the credentials can be exploited by anyone with physical or console access to the system, potentially through default service accounts, hardcoded passwords, or insufficiently complex initial credentials that persist across installations. The unchanged scope (S:U) indicates the vulnerability is confined to the vulnerable component itself.
RemediationAI
Upgrade Dell PowerProtect Data Domain DD OS to patched versions per release branch: DD OS 8.6.0.0 or later for Feature Release deployments, DD OS 8.3.1.30 for LTS2025 deployments, or DD OS 7.13.1.50 or later for LTS2024 deployments as documented in Dell Security Advisory DSA-2026-060 (https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities). If immediate patching is not feasible, implement compensating controls by restricting physical and console access to PowerProtect systems to only essential personnel through enhanced physical security measures, disabling unnecessary local login interfaces, implementing mandatory password changes for all default accounts, enforcing multi-factor authentication for administrative access where supported, and deploying network segmentation to isolate backup infrastructure from general IT networks. Monitor authentication logs for anomalous local login attempts, though this provides detection rather than prevention. Note that restricting local access may impact legitimate administrative workflows and emergency recovery procedures, requiring documented procedures for break-glass access scenarios.
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection
d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote at
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Same weakness CWE-1391 – Use of Weak Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today