Cloudanix VulnDB

CVE-2026-23370

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A debug statement in Dell hardware management code on Linux could write passwords in plain text to logs, allowing anyone who reads those logs to see the passwords.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Credential Exposure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

set_new_password() in dell-wmi-sysman performs a hex dump of the full buffer containing plaintext current and new passwords, exposing credential material through debug or log output.

Why it matters to the business

Administrators managing Dell systems via Linux kernel interfaces risk credential exposure in logs, which can lead to unauthorized system access and operational disruption on affected hardware.

How an attack unfolds

A local user or process with access to kernel debug output or logs reads the hex dump produced during password change operations, directly obtaining plaintext credentials without further interaction.

How to fix it

Apply the upstream kernel commit that removes the hex dump from set_new_password(); rebuild and deploy the patched kernel on all affected Linux systems.

How to confirm the fix worked

Confirm the absence of hex-dump calls in the dell-wmi-sysman password handling path after patching; review kernel source or runtime debug output for credential leakage.

Typical attack path

  1. Obtain local access or log visibility on a system using dell-wmi-sysman
  2. Trigger or observe a set_new_password() call via sysfs or management interface
  3. Inspect resulting debug hex dump to extract current and new passwords
  4. Use recovered credentials for privilege escalation or lateral movement

How to detect it

Search kernel logs and debug buffers for hex-dump output generated during password change operations on Dell systems; correlate with timestamps of password updates.

What your security team should do

  • Prioritize patching Linux kernels on Dell platforms using sysman password interfaces
  • Audit existing kernel logs for any prior hex dumps containing password material
  • Restrict local access and log visibility to the minimum required for administration

The record

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data set_new_password() hex dumps the entire buffer, which contains plaintext password data, including current and new passwords. Remove the hex dump to avoid leaking credentials.

Affected packages

Ecosystem Package Introduced Fixed