CVE-2025-43914: Dell Data Domain Privilege Escalation Flaw

CVE-2025-43914 Overview

CVE-2025-43914 is an Incorrect Privilege Assignment vulnerability [CWE-266] in Dell PowerProtect Data Domain BoostFS for Linux Ubuntu systems. The flaw affects Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release 8.3.1.0, LTS2024 releases 7.13.1.0 through 7.13.1.30, and LTS 2023 releases 7.10.1.0 through 7.10.1.60. A local, low-privileged attacker can leverage improper privilege assignment on the affected host to gain unauthorized access to resources beyond their authorization boundary. Dell disclosed the issue in security advisory DSA-2025-333.

Critical Impact
A local low-privileged user can escalate access on affected BoostFS-enabled Linux Ubuntu hosts, compromising the confidentiality, integrity, and availability of protected backup data.

Affected Products

Dell PowerProtect Data Domain BoostFS for Linux Ubuntu, Feature Release 7.7.1.0 through 8.3.0.15
Dell PowerProtect Data Domain BoostFS for Linux Ubuntu, LTS2025 release 8.3.1.0 and LTS2024 releases 7.13.1.0 through 7.13.1.30
Dell PowerProtect Data Domain BoostFS for Linux Ubuntu, LTS 2023 releases 7.10.1.0 through 7.10.1.60

Discovery Timeline

2025-10-07 - CVE-2025-43914 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43914

Vulnerability Analysis

CVE-2025-43914 is a local privilege issue in the BoostFS component of Dell PowerProtect Data Domain. BoostFS provides a FUSE-based interface that allows Linux hosts to mount Data Domain storage as a filesystem for backup applications. The component assigns privileges to a subject incorrectly, allowing operations that should require higher authorization to be performed by a low-privileged local account.

Successful exploitation grants an attacker access to files, backup data, or administrative functions they should not be able to reach. Because BoostFS interfaces directly with Data Domain storage, unauthorized access at this layer can expose backup content used for disaster recovery and ransomware resilience. Exploitation requires an existing local foothold, which raises the bar but does not eliminate risk in shared or multi-tenant Linux environments.

Root Cause

The root cause is an Incorrect Privilege Assignment weakness [CWE-266]. BoostFS grants a subject privileges that exceed what its authorization level should permit, resulting in a mismatch between the intended access model and the effective one enforced on the Linux host.

Attack Vector

The attack requires local access with low privileges and no user interaction. An attacker who already holds a shell on an affected Ubuntu system running BoostFS can invoke functionality that operates with elevated rights. No public proof-of-concept code is available at the time of writing. See the Dell Security Update DSA-2025-333 advisory for vendor-specific technical detail.

Detection Methods for CVE-2025-43914

Indicators of Compromise

Unexpected access to BoostFS mount points or Data Domain backup files by non-administrative Linux accounts.
Local user accounts invoking BoostFS binaries or FUSE mount operations outside of documented backup workflows.
Modification of file ownership or permissions under BoostFS-managed paths without a corresponding change control record.

Detection Strategies

Inventory Ubuntu hosts running BoostFS and confirm the installed version against the fixed releases listed in Dell DSA-2025-333.
Correlate Linux auditd events for execve, setuid, and BoostFS binary invocations with the identity of the invoking user.
Alert on privilege transitions where a low-privileged UID accesses resources normally reserved for backup service accounts.

Monitoring Recommendations

Ship auditd, syslog, and BoostFS logs to a centralized analytics platform for behavioral baselining of backup client activity.
Track new local process ancestry involving BoostFS mount and control utilities from non-backup users.
Monitor Data Domain audit logs for authentication or session anomalies originating from BoostFS clients.

How to Mitigate CVE-2025-43914

Immediate Actions Required

Identify all Linux Ubuntu hosts running Dell PowerProtect Data Domain BoostFS and cross-reference versions with the affected ranges in DSA-2025-333.
Apply the fixed BoostFS release published by Dell for your maintenance track (Feature Release, LTS2025, LTS2024, or LTS 2023).
Restrict interactive local access on backup infrastructure hosts to a minimal set of administrators until patching is complete.

Patch Information

Dell has published fixed releases and remediation guidance in Dell Security Update DSA-2025-333. Administrators should upgrade BoostFS to the vendor-designated fixed version for their release train and validate integrity of backup jobs after the upgrade.

Workarounds

Limit shell and SSH access on BoostFS client hosts to authorized backup administrators only.
Enforce least-privilege on local user accounts and remove unnecessary group memberships that grant access to BoostFS paths or binaries.
Segment backup client hosts on dedicated management networks to reduce the number of local users who could stage an exploit.

bash

# Configuration example
# Verify installed BoostFS version on an affected Ubuntu host
dpkg -l | grep -i boostfs

# Restrict access to BoostFS mount and binaries to the backup admin group
sudo chown root:backup-admins /usr/local/boostfs/bin/*
sudo chmod 750 /usr/local/boostfs/bin/*