LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23370: platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data set_new_password() hex dumps the entire buffer, which contains plaintext password data, including current and new passwords. Remove the hex dump to avoid leaking credentials.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue could expose firmware or system-management passwords because a Dell WMI password-change routine logged the whole password buffer in hex. The public record does not provide a CVSS score or confirm exploitation. Treat it as a credential-exposure risk on affected systems, especially where logs are collected broadly.

Executive priority

Prioritize normal security patching, with faster handling for Dell-managed Linux fleets, industrial products, or environments where logs are broadly accessible. Escalate if evidence shows password changes occurred and logs left controlled systems.

Technical view

The platform/x86 dell-wmi-sysman set_new_password() path hex dumped a buffer containing plaintext current and new passwords. The fix removes that dump. The source bundle identifies Linux kernel impact and multiple stable commits, but does not describe attacker prerequisites, log destinations, or exact distribution package status.

Likely exposure

Exposure is most likely on affected Linux kernels using the dell-wmi-sysman password-management path. Practical risk depends on whether password changes occurred and whether kernel or system logs were retained or accessible to administrators, support tooling, or log platforms.

Exploitation context

The bundle marks KEV as false and provides no cited evidence of active exploitation. This appears to be an information disclosure through logging, not remote code execution. Evidence is incomplete on required privileges, affected deployments, and whether logs are readable by unprivileged users.

Researcher notes

Do not assume broad exploitability from the CVE text. Focus analysis on the set_new_password() call path, log emission behavior, kernel version mapping, and downstream vendor backports. The source bundle lacks CVSS, CWE, and detailed attack prerequisites.

Mitigation direction

  • Apply kernel or distribution updates containing the referenced stable fixes.
  • Check Linux vendor guidance for exact fixed package versions.
  • Check Siemens advisories if Siemens products use affected Linux builds.
  • Restrict access to kernel, system, and centralized logs.
  • Rotate affected passwords if password changes occurred and logs were exposed.

Validation and detection

  • Inventory Linux kernel versions against vendor fixed-version guidance.
  • Determine whether dell-wmi-sysman is present and used on managed systems.
  • Review whether password changes occurred on affected kernels.
  • Check retention and access scope for kernel and system logs.
  • Confirm deployed kernels include the upstream stable fix.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-23370 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe8a60aa7404bfef37705da5607c97737073ac38d, e8a60aa7404bfef37705da5607c97737073ac38d, e8a60aa7404bfef37705da5607c97737073ac38d, e8a60aa7404bfef37705da5607c97737073ac38d, e8a60aa7404bfef37705da5607c97737073ac38d, e8a60aa7404bfef37705da5607c97737073ac38d, e8a60aa7404bfef37705da5607c97737073ac38dunaffected
LinuxLinux5.11, 0, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.