Read the docs
TI-2018-01120 Aliases CVE-2018-1206GHSA-7c88-c2gq-h35v

Hard-coded credentials in Dell EMC Data Protection Advisor versions prior to 6.3 Patch…

Priority LOW 34CWE-798Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-798.

Summary

Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159 and Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110 contain a hardcoded database account with administrative privileges. The affected account is "apollosuperuser." An attacker with local access to the server where DPA Datastore Service is installed and knowledge of the password may potentially gain unauthorized access to the database. Note: The Datastore Service database cannot be accessed remotely using this account.

Why it matters now

EPSS 0.00345 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159 and Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159 and Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110—No fix listedCNA
  • Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159 and Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110 Vendor— Affected Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159 and Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:emc:data_protection_advisor:6.3.0:*:*:*:*:*:*:*6.3.0VulnerableEMC
cpe:2.3:a:emc:data_protection_advisor:6.4.0:*:*:*:*:*:*:*6.4.0VulnerableEMC
  • cpe:2.3:a:emc:data_protection_advisor:6.3.0:*:*:*:*:*:*:* Versions 6.3.0 Vulnerable ·EMC
  • cpe:2.3:a:emc:data_protection_advisor:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·EMC

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1206
  2. 2026-10-03 Alias added: GHSA-7c88-c2gq-h35v

References

Advisory 1

  • TI-2017-08041 OS command injection in Dell EMC Data Protection Advisor CVSS 3.1HIGH 8.8
  • TI-2017-05611 Hard-coded credentials in Dell EMC EMC Data Protection Advisor CVSS 3.0CRITICAL 9.8
  • TI-2012-00371 The DPA_Utilities.cProcessAuthenticationData function in EMC Data Protection Advisor… CVSS 2.0HIGH 7.8
  • TI-2017-05603 SQL injection in EMC Data Protection Advisor prior to 6.4 CVSS 3.0HIGH 8.8
  • TI-2012-00372 Integer overflow in the DPA_Utilities library in EMC Data Protection Advisor (DPA) 5.5… CVSS 2.0MEDIUM 5.0
  • TI-2017-05604 Path traversal in EMC Data Protection Advisor prior to 6.4 CVSS 3.0MEDIUM 4.9
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences