Dell Repository Manager CVE-2025-45376

Exploitation requires (1) local access to the host running Dell Repository Manager and (2) a pre-existing low-privileged account or process on that system - per CVSS AV:L and PR:L, this is NOT remotely or anonymously exploitable. No user interaction is needed (UI:N) and attack complexity is low (AC:L) once local low-privilege access is held. The limiting factors are therefore the local-only vector and the mandatory authenticated low-privilege foothold; exploitation is further bounded to systems actually running the affected DRM versions 3.4.7 or 3.4.8. The specific DRM feature, service, or file-permission weakness being abused is not named in the available description.

This is a classic local privilege-escalation issue (CWE-280, Improper Handling of Insufficient Permissions or Privileges) that is genuinely MEDIUM priority rather than an urgent emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) is internally consistent with the description: an attacker needs local access and already-existing low privileges (PR:L), but once those are met, exploitation is low-complexity (AC:L) with no user interaction and yields full confidentiality, integrity, and availability impact on the host. All exploitation signals point AWAY from mass exploitation: EPSS is only 0.01% (1st percentile), the vulnerability is NOT on the CISA KEV list, and no public exploit code was identified in the provided data. The local attack vector plus a pre-existing foothold requirement is the dominant mitigating factor - this cannot be triggered remotely or by an unauthenticated actor. No SSVC decision data was provided in the input, so exploitation/automatable/technical-impact framework values could not be evaluated. Bottom line: a legitimately exploitable local EoP that matters for defense-in-depth and multi-user/hardened Dell management hosts, but not a drop-everything network-facing threat.

An attacker who already has a low-privileged local account (or has compromised a low-privilege service/user) on a host running Dell Repository Manager 3.4.7 or 3.4.8 abuses the product's improper handling of insufficient permissions to gain elevated/administrative privileges on that system. Because the CVSS complexity is low (AC:L) and no user interaction is required, the escalation is reliable once local access exists. No public proof-of-concept exploit was identified at the time of analysis, so this reflects the vendor-described capability rather than a published exploit.