Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain appliances with Data Domain Operating System versions 8.0 through 8.5 and LTS2025 release version 8.3.1.0 through 8.3.1.10 contain a vulnerability that allows the insertion of sensitive information into log files. A low privileged attacker with remote access could exploit this vulnerability, potentially leading to credential exposures. This issue only affects systems with retention lock enabled.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.6 | CVE-2026-23775 |
Exploitation
To exploit this vulnerability, an attacker with low privileges must have remote access to the affected system. They can then attempt to authenticate as a compromised user, but this requires authorization from a high privileged DD user. If successful, the attacker may gain access to sensitive information logged by the system.
Affected Products
- PowerProtect Data Domain OS versions 8.0 to 8.5: Vulnerable to log file information exposure.
- PowerProtect Data Domain OS LTS2025 version 8.3.1.0 to 8.3.1.10: Also affected by the same vulnerability.
Mitigation
To mitigate this vulnerability, users should ensure that retention lock is disabled if not needed. Additionally, it is recommended to apply the latest security updates provided by Dell to protect against potential exploitation.