A critical vulnerability in Dell’s Compellent Integration Tools for VMware (CITV) could allow threat actors to decrypt and exfiltrate administrator credentials in plaintext. Dell Compellent Storage Center is an enterprise storage solution for virtualized data centers and cloud infrastructure. The flaw, tracked as CVE-2023-39250, results from a hardcoded AES encryption key used to encrypt the CITV configuration file. The file contains the program’s settings, which could be identified by an attacker who has gained access to the victim network. Once initial access has been achieved, the attacker can decode the private key associated with VMware’s centralized management utility through Dell Compellent, enabling the full takeover of a VMware environment. To make matters worse, because AES is a symmetric cipher, the key is identical for every single Dell customer, so a compromise of one entity could easily lead to the compromise of many more entities. The vulnerability was exploited by Tom Pohl, the manager of the penetration testing team at LMG security, demonstrating his findings at the DEF CON 31 hacking convention this month after the standard 90-day vulnerability disclosure policy had expired. This flaw has not yet been patched and LMG Security researchers expect Dell will not be able to patch the vulnerability until Fall 2023. In the meantime, Dell has published mitigation instructions to defend against exploitation. The instructions can be found in the Dell advisory link below, and CTIX analysts recommend that any administrators responsible for these environments apply the manual workarounds as soon as possible.