---
id: CVE-2025-36568
title: >-
  Dell PowerProtect Data Domain BoostFS for client of Feature Release versions
  7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024
  release versions 7.13.1.0 through 7.13.1.50, contain an insufficiently
  protected …
summary: >-
  Dell PowerProtect Data Domain BoostFS for client of Feature Release versions
  7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024
  release versions 7.13.1.0 through 7.13.1.50, contain an insufficiently
  protected …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-522
vendor: dell
product: data_domain_operating_system
affected:
  - 'data_domain_operating_system >= 7.7.1.0, < 7.13.1.60'
  - 'data_domain_operating_system >= 7.14.0.0, < 8.3.1.30'
  - 'data_domain_operating_system >= 8.4.0.0, < 8.6.0.0'
patched:
  - data_domain_operating_system 8.6.0.0
published: '2026-04-17'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T22:10:00.273'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-36568'
references:
  - url: >-
      https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
    label: security_alert@emc.com
tags:
  - nvd
epss: 0.0011
epssPercentile: 0.01173
ingestedAt: '2026-09-30T22:27:27.761Z'
---

## Overview

Dell PowerProtect Data Domain BoostFS for client of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain an insufficiently protected credentials vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to credential exposure. The attacker may be able to use the exposed credentials to access the system with privileges of the compromised account.

## Affected

- `data_domain_operating_system >= 7.7.1.0, < 7.13.1.60`
- `data_domain_operating_system >= 7.14.0.0, < 8.3.1.30`
- `data_domain_operating_system >= 8.4.0.0, < 8.6.0.0`

## Remediation

Upgrade past the affected range:

- `data_domain_operating_system 8.6.0.0`