The vulnerability arises from credentials that are not adequately protected within Dell PowerProtect Data Domain BoostFS. A local attacker with low privileges can acquire these exposed credentials, subsequently using them to access the system with the full rights of the compromised account. The impact is therefore the potential loss of confidentiality, integrity, and availability of data and services governed by those credentials.

Affected are Dell PowerProtect Data Domain BoostFS clients on Feature Release versions 7.7.1.0 through 8.5, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.50. Only these specific releases contain the insufficiently protected credentials flaw.

With a CVSS score of 7.8, the vulnerability is considered high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed field‑of‑view exploitation yet. The attack vector is local: a low privileged attacker who gains physical or local network access can exploit the weakness. The lack of a patch or mitigation at the time of reporting increases the risk that an attacker could leverage the exposed credentials to elevate privileges and compromise the system.