CVE-2026-80359 in Boot Optimized Server Storage
Summary
by MITRE • 09/28/2026
Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Unauthorized access.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/28/2026
The Dell Boot Optimized Server Storage (BOSS) solution is a critical component of modern enterprise server infrastructure, designed to provide high-performance boot and storage capabilities for data center environments. Specifically, the BOSS-N1 controllers found in 17th generation servers utilize an System Management Control Unit (SMCU) to manage low-level hardware interactions, including power management, thermal monitoring, and firmware updates. A significant security flaw has been identified within this architecture affecting versions prior to 2.2.13.2038. The vulnerability centers on the On-Chip Debug and Test Interface, commonly referred to as JTAG or similar debug ports, which are intended for manufacturing testing and field service diagnostics but were left with improper access control mechanisms in the SMCU firmware.
This technical flaw represents a classic case of insecure configuration where sensitive debugging interfaces remain enabled without adequate authentication checks during normal operational modes. The presence of an unauthenticated entry point into the system management controller allows any individual with physical proximity to the server hardware to interact directly with the internal bus and memory structures of the SMCU. By leveraging standard debug tools, an attacker can bypass higher-level security controls such as BIOS passwords or operating system authentication layers. This effectively grants the attacker a low-level shell within the server's management plane, enabling them to read sensitive data stored in volatile and non-volatile memory, modify firmware settings, or inject malicious code into the boot process.
The operational impact of this vulnerability is severe due to its reliance on physical access rather than network connectivity. While it does not allow for remote exploitation over the internet, it poses a critical risk in environments where server racks are accessible to unauthorized personnel, such as co-location facilities with inadequate physical security or internal networks where employees have unrestricted hardware access. An attacker could extract cryptographic keys, session tokens, and other sensitive credentials stored within the system management controller's memory space. Furthermore, by modifying firmware configurations, an attacker could disable logging mechanisms, alter boot sequences to load malicious kernels, or permanently compromise the integrity of the server through persistent rootkits embedded in the BMC or SMCU firmware.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-753 Insecure Default Configuration of an Important Component. It also maps to MITRE ATT&CK techniques related to Hardware Abuse, specifically T1059 Command and Scripting Interpreter if the attacker executes commands via the debug interface, or T1608 Install Defective Firmware for persistent compromise. The lack of authentication on a privileged hardware interface violates fundamental security principles regarding least privilege and defense in depth, as it assumes physical isolation is sufficient protection without implementing cryptographic verification or access restrictions at the silicon level.
Mitigation strategies must focus primarily on patching and configuration hardening. Dell has released version 2.2.13.2038 of the BOSS firmware which addresses this improper access control issue by disabling or properly securing the debug interface during normal operation. Administrators should immediately update all affected servers to this patched version or later. In addition to software updates, organizations must enforce strict physical security controls around server racks and data centers to prevent unauthorized individuals from accessing hardware ports. This includes using locked cages, biometric access controls for server rooms, and continuous surveillance monitoring. For environments where immediate patching is not feasible due to operational constraints, disabling unused debug interfaces via BIOS settings or utilizing tamper-evident seals on chassis covers can serve as temporary compensating controls to reduce the attack surface until a maintenance window allows for firmware remediation.