Missing brute-force protection in Dell Integrated Data Protection Appliance
Priority MEDIUM 42CWE-307Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-307.
Summary
Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote user may exploit this vulnerability to launch a brute-force authentication attack in order to gain access to the system.
Why it matters now
EPSS 0.02121 81st percentileScored 2026-11-07
Fix Fixed Integrated Data Protection Appliance (Dell): 2.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | Integrated Data Protection Appliance | before 2.3 | 2.3 | Patch available | CNA |
- Integrated Data Protection Appliance VendorDell Affected before 2.3 Fixed in 2.3 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | Dell |
| cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.1:*:*:*:*:*:*:* | 2.1 | Vulnerable | Dell |
| cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.2:*:*:*:*:*:*:* | 2.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:emc_idpa_dp4400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:emc_idpa_dp5800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:emc_idpa_dp8300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:emc_idpa_dp8800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
- cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Dell
- cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Dell
- cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Dell
- cpe:2.3:h:dell:emc_idpa_dp4400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:emc_idpa_dp5800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:emc_idpa_dp8300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:emc_idpa_dp8800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Remediation
- Fix · CNA Integrated Data Protection Appliance (Dell) Fixed in 2.3
Timeline
- 2026-10-02 Threatist record created from CVE-2019-3746
- 2026-10-03 Alias added: GHSA-3q4q-6vxp-x66f
References
More Dell Emc Integrated Data Protection Appliance Firmware vulnerabilities
- TI-2020-04393 Deserialization of untrusted data in Dell Avamar Virtual Edition CVSS 3.1CRITICAL 9.8
- TI-2019-13451 Code injection in Dell Data Protection Advisor CVSS 3.1HIGH 7.2
- TI-2019-13450 Missing authorization in Dell Data Protection Advisor CVSS 3.1HIGH 7.2
- TI-2019-02755 Broken or risky cryptographic algorithm in Dell Integrated Data Protection Appliance CVSS 3.1HIGH 7.2
- TI-2019-02765 Cross-site scripting in Dell Integrated Data Protection Appliance CVSS 3.1MEDIUM 4.8
Sources
- CVE-2019-3746 · CVE Program
- CVE-2019-3746 · NVD
- FIRST EPSS
- GHSA-3q4q-6vxp-x66f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences