CVE-2026-23370 — Plaintext Storage of a Password in Linux
Severity
4.4MEDIUM
No vectorEPSS
0.0%
top 90.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data
set_new_password() hex dumps the entire buffer, which contains plaintext
password data, including current and new passwords. Remove the hex dump
to avoid leaking credentials.
Affected Packages5 packages
▶CVEListV5linux/linuxe8a60aa7404bfef37705da5607c97737073ac38d — d9e785bd62d2ac23cf29a75dcfea8c8087fd3870+6
🔴Vulnerability Details
3OSV▶
CVE-2026-23370: In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data set_new_pass↗2026-03-25
GHSA▶
GHSA-qvvw-8673-33g5: In the Linux kernel, the following vulnerability has been resolved:
platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data
set_new_pa↗2026-03-25
📋Vendor Advisories
3Debian▶
CVE-2026-23370: linux - In the Linux kernel, the following vulnerability has been resolved: platform/x8...↗2026