CVE-2026-80358 in Boot Optimized Server Storage
Summary
by MITRE • 09/28/2026
Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Unauthorized access.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/28/2026
The Dell Boot Optimized Server Storage (BOSS) solution, specifically versions prior to 2.2.13.2038 deployed on the BOSS-N1 controllers for PowerEdge servers equipped with System Management Controller Units (SMCU), contains a critical security flaw related to improper access control mechanisms governing its On-Chip Debug and Test Interface. This interface is designed primarily for manufacturing, debugging, and diagnostic purposes during the hardware development lifecycle but remains accessible in production environments due to insufficient hardening of the underlying firmware or hardware configuration. The vulnerability stems from the failure to properly restrict or disable these debug ports after deployment, leaving them exposed to physical interaction by any individual who gains direct access to the server chassis. This represents a significant deviation from secure-by-design principles where sensitive low-level interfaces should be permanently disabled or cryptographically locked in operational settings.
From a technical perspective, the On-Chip Debug and Test Interface typically provides read-write access to memory regions that are otherwise inaccessible through standard operating system APIs or management controllers like iDRAC. An attacker with physical presence can utilize this interface to dump firmware images, extract cryptographic keys stored in volatile or non-volatile memory, modify boot sequences, or inject malicious code directly into the storage controller's execution environment. Because the SMCU manages critical data path operations and interacts closely with the host system’s BIOS/UEFI, compromising it allows for deep persistence within the server infrastructure. The lack of authentication requirements means that no credentials are needed to initiate these attacks, making exploitation trivial for anyone who can physically connect a debugger such as JTAG or SWD probes to the exposed test points on the motherboard or controller card.
The operational impact of this vulnerability is severe and multifaceted. Unauthorized access via this vector enables an attacker to bypass traditional network-based security controls entirely since physical proximity is sufficient for exploitation. Once inside, the adversary can exfiltrate sensitive data including database contents, user credentials, and encryption keys used by applications running on or connected to the server. Furthermore, they may alter firmware settings to ensure persistent access even after reboots, effectively establishing a rootkit-level foothold that survives operating system reinstalls unless the storage controller itself is reflashed with verified signatures. This also facilitates lateral movement within the data center if adjacent systems share trust relationships based on compromised credentials or keys extracted from this vulnerable component.
This vulnerability aligns closely with CWE-284, which describes Improper Access Control, specifically where access control decisions are not enforced correctly for sensitive interfaces. In terms of offensive security frameworks, it maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter through physical hardware manipulation tools like JTAG debuggers, falling under the broader category of Hardware Injection or Physical Interaction attacks such as those categorized in TA0040 Impact or TA0006 Discovery depending on whether data is stolen or system state is modified. The attack vector requires Local/Physical access (AV:P), which limits remote exploitation but does not mitigate risk for facilities with inadequate physical security protocols, shared server rooms, or environments where hardware maintenance personnel have unrestricted access without supervision.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Dell has released firmware version 2.2.13.2038 which addresses this issue by disabling the On-Chip Debug and Test Interface in production builds or implementing strict authentication requirements for its use. Administrators should immediately update all affected BOSS-N1 controllers to this patched version or later. Beyond software updates, organizations must enforce rigorous physical security measures including locked server racks, controlled access zones using biometric or badge-based entry systems, and continuous video surveillance of hardware maintenance areas. Additionally, implementing TPM (Trusted Platform Module) usage for secure boot validation can help detect unauthorized firmware modifications even if an attacker attempts to exploit this interface. Regular audits of physical asset inventory and monitoring for unusual hardware tampering indicators are also recommended to complement technical controls in defending against insider threats or malicious actors with brief periods of unsupervised physical access.