CVE-2025-36568: Dell Data Domain Information Disclosure

CVE-2025-36568 Overview

CVE-2025-36568 is an insufficiently protected credentials vulnerability affecting Dell PowerProtect Data Domain BoostFS. The vulnerability exists in multiple release versions of the Dell Data Domain Operating System, where credentials are not adequately protected. A low-privileged attacker with local access could potentially exploit this vulnerability to gain access to exposed credentials, enabling them to access the system with the privileges of the compromised account.

Critical Impact

Local attackers with low privileges can exploit insufficiently protected credentials to escalate their access, potentially gaining full control over the Dell PowerProtect Data Domain system with the compromised account's privileges.

Affected Products

• Dell PowerProtect Data Domain BoostFS Feature Release versions 7.7.1.0 through 8.5
• Dell PowerProtect Data Domain BoostFS LTS2025 release versions 8.3.1.0 through 8.3.1.20
• Dell PowerProtect Data Domain BoostFS LTS2024 release versions 7.13.1.0 through 7.13.1.50

Discovery Timeline

• April 17, 2026 - CVE-2025-36568 published to NVD
• April 20, 2026 - Last updated in NVD database

Technical Details for CVE-2025-36568

Vulnerability Analysis

This vulnerability is classified under CWE-522 (Insufficiently Protected Credentials), indicating that the affected Dell PowerProtect Data Domain BoostFS software fails to adequately protect stored or transmitted credentials. The flaw allows attackers with local access and minimal privileges to extract sensitive credential information that should be protected.

The vulnerability requires local access to exploit, meaning an attacker must already have some level of system access before they can leverage this weakness. Once exploited, the attacker can obtain credentials that may provide elevated privileges or access to additional systems within the environment.

Dell PowerProtect Data Domain systems are commonly deployed in enterprise backup and disaster recovery environments, making this vulnerability particularly concerning for organizations relying on these systems to protect critical data. Successful exploitation could compromise backup infrastructure integrity and potentially provide attackers with pathways to access backed-up data or pivot to other systems.

Root Cause

The root cause of CVE-2025-36568 lies in the improper handling of credential storage or transmission within the Dell PowerProtect Data Domain BoostFS client software. The credentials are stored or handled in a manner that does not meet security best practices, allowing them to be accessed by users with lower privilege levels than intended.

This typically manifests as credentials stored in plaintext files, weakly encrypted configuration files, or accessible memory locations that can be read by local users. The insufficient protection mechanism fails to properly restrict access to these sensitive credentials based on user privilege levels.

Attack Vector

The attack vector for this vulnerability is local, requiring the attacker to have existing access to the target system. The exploitation scenario involves:

1. An attacker gains initial low-privilege local access to a system running the affected Dell PowerProtect Data Domain BoostFS client
2. The attacker locates and accesses insufficiently protected credential storage locations
3. Credentials are extracted from files, configuration stores, or memory
4. The attacker uses the obtained credentials to authenticate with elevated privileges or access additional protected resources

Due to the local attack vector requirement, remote exploitation is not directly possible. However, the vulnerability could be chained with other attack techniques to facilitate credential theft as part of a broader compromise.

Detection Methods for CVE-2025-36568

Indicators of Compromise

• Unusual access patterns to credential storage files or directories associated with Dell PowerProtect Data Domain BoostFS
• Unexpected process execution by low-privileged accounts attempting to read protected configuration files
• Authentication events using service accounts from unexpected sources or user contexts
• File system access logs showing read operations on credential-related files by non-administrative users

Detection Strategies

• Monitor file access logs for credential storage locations within the Dell PowerProtect Data Domain BoostFS installation directories
• Implement endpoint detection rules to alert on suspicious credential dumping tools or techniques targeting backup software
• Configure SIEM rules to correlate unusual local authentication attempts with file access events on affected systems
• Deploy behavioral analytics to identify privilege escalation patterns following credential access attempts

Monitoring Recommendations

• Enable detailed audit logging on all systems running affected versions of Dell PowerProtect Data Domain BoostFS
• Configure file integrity monitoring on credential storage locations to detect unauthorized access or modifications
• Implement privileged access monitoring to track usage of service accounts associated with backup operations
• Establish baseline normal behavior for credential access and alert on deviations

How to Mitigate CVE-2025-36568

Immediate Actions Required

• Review Dell's security advisory DSA-2026-060 and apply recommended updates immediately
• Audit current system access to identify and remove unnecessary local user accounts from affected systems
• Implement strict access controls limiting local access to systems running Dell PowerProtect Data Domain BoostFS
• Rotate credentials associated with the affected software as a precautionary measure

Patch Information

Dell has released security updates addressing this vulnerability. Administrators should consult the Dell Security Update DSA-2026-060 for specific patch information and upgrade paths for their deployed versions.

Affected organizations should prioritize upgrading:

• Feature Release versions 7.7.1.0 through 8.5 to the latest patched release
• LTS2025 release versions 8.3.1.0 through 8.3.1.20 to a patched LTS2025 version
• LTS2024 release versions 7.13.1.0 through 7.13.1.50 to a patched LTS2024 version

Workarounds

• Restrict local access to systems running Dell PowerProtect Data Domain BoostFS to only essential administrative personnel
• Implement network segmentation to isolate backup infrastructure from general user access
• Apply the principle of least privilege to all accounts with access to affected systems
• Monitor credential usage patterns and implement additional authentication controls where possible

# Example: Restrict file permissions on credential directories
# Adjust paths according to your installation
chmod 700 /path/to/boostfs/config/
chown root:root /path/to/boostfs/config/
# Review and audit current access
ls -la /path/to/boostfs/config/