Product:
PowerProtect Data Manager
Summary
Dell PowerProtect Data Manager contains a Plaintext Storage of a Password vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to gain unauthorized access with privileges of the compromised account.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5 | CVE-2025-43938 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the affected system and possess high privileges. Once access is gained, the attacker can retrieve stored passwords in plaintext, which can then be used to impersonate users or escalate privileges within the system.
Affected Products
- PowerProtect Data Manager 19.19: Contains the vulnerability allowing plaintext storage of passwords.
- PowerProtect Data Manager 19.20: Also affected by the same vulnerability, enabling potential credential disclosure.
Mitigation
To mitigate this vulnerability, users should ensure that they are using the latest version of Dell PowerProtect Data Manager and apply any available security updates. Additionally, restricting local access to the system and implementing strong password policies can help reduce the risk of exploitation.