Critical Vulnerability in Dell RecoverPoint for Virtual Machines Due to Hard-Coded Credentials

What changed

Dell has disclosed a critical vulnerability in its RecoverPoint for Virtual Machines (RP4VMs) software, specifically versions prior to 6.0.3.1 HF1. The issue arises from the presence of hard-coded credentials, which can be exploited by an unauthenticated remote attacker.

This vulnerability poses a significant risk as it could allow unauthorized access to the underlying operating system, enabling root-level persistence.

Who is affected

Organizations utilizing Dell RecoverPoint for Virtual Machines are at risk, particularly those running versions before the specified update.

The following groups are specifically impacted:

• Enterprises relying on Dell RecoverPoint for Virtual Machines for data protection and disaster recovery.
• IT departments managing virtualized environments that incorporate RP4VMs.
• Organizations with compliance requirements that mandate secure credential management.

What to do

Dell strongly advises all customers to upgrade to version 6.0.3.1 HF1 or apply the recommended remediations as soon as possible to mitigate the risks associated with this vulnerability.

Immediate action is essential to prevent potential exploitation and unauthorized access.

• Review current version of Dell RecoverPoint for Virtual Machines in use.
• Implement the latest updates provided by Dell to secure the environment.
• Monitor for any suspicious activity that may indicate exploitation attempts.