Dell PowerProtect BoostFS Credential Exposure Vulnerability

Dell PowerProtect Data Domain BoostFS, across multiple Feature Release and LTS versions (7.7.1.0-8.5, 8.3.1.0-8.3.1.20, 7.13.1.0-7.13.1.50), contains a critical credential exposure vulnerability, CVE-2025-36568. The National Vulnerability Database assigns it a CVSS score of 7.8 (HIGH), highlighting the severity.

This flaw, categorized as CWE-522 (Insufficiently Protected Credentials), allows a low-privileged local attacker to potentially gain access to sensitive credentials. The attacker could then leverage these exposed credentials to elevate privileges and gain unauthorized access to the system, as reported by the National Vulnerability Database.

For defenders, this is a clear call to action. Any local access, even by a low-privileged user, can escalate into a full compromise. The attacker’s calculus here is simple: find a weak link, grab credentials, and pivot. This isn’t about sophisticated remote exploits; it’s about internal hygiene and privilege management. Patching is non-negotiable, but so is auditing local access controls and ensuring least privilege is strictly enforced for all users interacting with Dell PowerProtect Data Domain BoostFS.