What is the CVSS score of EUVD-2025-209517?

EUVD-2025-209517 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Dell are affected by EUVD-2025-209517?

Dell PowerProtect Data Domain BoostFS client versions 7.7.1.0 through 8.5 and specified LTS releases contain insufficiently protected credentials that allow local low-privileged users to extract…. A patch is available.

How to fix or mitigate EUVD-2025-209517?

Within 24 hours: inventory all systems running Dell PowerProtect Data Domain BoostFS client versions 7.7.1.0-8.5, 7.13.1.0-7.13.1.50, and 8.3.1.0-8.3.1.20; restrict local access to systems running affected versions. Within 7 days: contact Dell for patch timeline and mitigation guidance; implement privileged access management (PAM) controls on affected systems to monitor and restrict credential access. Within 30 days: apply vendor-released patch immediately upon availability; if patch delayed beyond 30 days, evaluate migration to patched alternative versions or air-gapping affected infrastructure.

Dell EUVD-2025-209517

| CVE-2025-36568 HIGH

Insufficiently Protected Credentials (CWE-522)

2026-04-17 dell

GHSA-q846-2w2g-p6v6

Information Disclosure Dell

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 20, 2026 - 18:10 nvd

Patch available

Apr 17, 2026 - 10:01 EUVD

Analysis Updated

Apr 17, 2026 - 09:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 17, 2026 - 09:22 vuln.today

cvss_changed

Analysis Generated

Apr 17, 2026 - 09:15 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 09:00 euvd

EUVD-2025-209517

Analysis Generated

Apr 17, 2026 - 09:00 vuln.today

CVE Published

Apr 17, 2026 - 08:12 nvd

HIGH 7.8

DescriptionCVE.org

Dell PowerProtect Data Domain BoostFS for client of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain an insufficiently protected credentials vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to credential exposure. The attacker may be able to use the exposed credentials to access the system with privileges of the compromised account.

AnalysisAI

Insufficiently protected credential storage in Dell PowerProtect Data Domain BoostFS client allows local attackers with low privileges to extract stored credentials via local file access under specific race conditions (AC:H). Scope change (S:C) indicates compromised credentials grant access beyond the BoostFS client component itself, potentially to connected Data Domain systems. Dell has released patches for all affected branches (Feature Release 7.7.1.0-8.5, LTS2025 8.3.1.0-8.3.1.20, LTS2024 7.13.1.0-7.13.1.50). EPSS score of 0.01% suggests minimal observed exploitation interest, no CISA KEV listing, and no public POC identified at time of analysis.

Technical ContextAI

Dell PowerProtect Data Domain BoostFS is a client-side network filesystem interface that enables backup applications to write data directly to Dell Data Domain deduplication storage appliances. The vulnerability is classified as CWE-522 (Insufficiently Protected Credentials), indicating credentials are stored in a manner accessible to unauthorized local users-typically through weak file permissions, reversible encryption, or predictable storage locations. The CVSS vector's high attack complexity (AC:H) suggests exploitation requires specific timing, race conditions, or non-default system states. The changed scope (S:C) is significant: it indicates the compromised credentials grant access to resources beyond the vulnerable BoostFS client component itself, likely enabling lateral movement to the connected Data Domain appliance or backup infrastructure with the privileges of the service account used for BoostFS operations.

RemediationAI

Apply Dell-released patches immediately for all affected BoostFS client installations: upgrade Feature Release deployments to version 8.6.0.0 or later, LTS2025 deployments to version 8.3.1.30 or later, and LTS2024 deployments to version 7.13.1.60 or later as specified in Dell Security Advisory DSA-2026-060 (https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities). Patching requires BoostFS client reinstallation or upgrade on backup application servers, which may necessitate brief backup service interruption during maintenance windows. If immediate patching is not feasible, implement compensating controls: restrict local user access to systems running BoostFS clients through operating system access controls, enable audit logging for credential file access attempts in the BoostFS installation directory, and review/rotate Data Domain service account credentials used by BoostFS with monitoring for anomalous authentication patterns. Note that credential rotation provides defense-in-depth but does not eliminate the underlying storage vulnerability until patching is complete.