Broken or risky cryptographic algorithm in Dell Integrated Data Protection Appliance
Priority LOW 33CWE-257Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-327.
Summary
Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a password storage vulnerability in the ACM component. A remote authenticated malicious user with root privileges may potentially use a support tool to decrypt encrypted passwords stored locally on the system to use it to access other components using the privileges of the compromised user.
Why it matters now
EPSS 0.007 53rd percentileScored 2026-11-07
Fix Fixed Integrated Data Protection Appliance (Dell): 2.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | Integrated Data Protection Appliance | before 2.3 | 2.3 | Patch available | CNA |
- Integrated Data Protection Appliance VendorDell Affected before 2.3 Fixed in 2.3 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | Dell |
| cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.1:*:*:*:*:*:*:* | 2.1 | Vulnerable | Dell |
| cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.2:*:*:*:*:*:*:* | 2.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:emc_idpa_dp4400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:emc_idpa_dp5800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:emc_idpa_dp8300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:emc_idpa_dp8800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
- cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Dell
- cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Dell
- cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Dell
- cpe:2.3:h:dell:emc_idpa_dp4400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:emc_idpa_dp5800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:emc_idpa_dp8300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:emc_idpa_dp8800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Remediation
- Fix · CNA Integrated Data Protection Appliance (Dell) Fixed in 2.3
Timeline
- 2026-10-02 Threatist record created from CVE-2019-3736
- 2026-10-03 Alias added: GHSA-q7wx-2q75-9872
References
More Dell Emc Integrated Data Protection Appliance Firmware vulnerabilities
- TI-2020-04393 Deserialization of untrusted data in Dell Avamar Virtual Edition CVSS 3.1CRITICAL 9.8
- TI-2019-02764 Missing brute-force protection in Dell Integrated Data Protection Appliance CVSS 3.1HIGH 8.8
- TI-2019-13451 Code injection in Dell Data Protection Advisor CVSS 3.1HIGH 7.2
- TI-2019-13450 Missing authorization in Dell Data Protection Advisor CVSS 3.1HIGH 7.2
- TI-2019-02765 Cross-site scripting in Dell Integrated Data Protection Appliance CVSS 3.1MEDIUM 4.8
Sources
- CVE-2019-3736 · CVE Program
- CVE-2019-3736 · NVD
- FIRST EPSS
- GHSA-q7wx-2q75-9872 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences