Dell Command Configure CVE-2026-103778

Requires local access to a system with Dell Command | Configure installed at a version prior to 5.2.3.35; no authentication or user interaction is needed once local access exists (AV:L/PR:N/UI:N). Exploitation hinges on the attacker recovering the hard-coded cryptographic key embedded in the product and having access to data encrypted with it. The primary limiting factor is the mandatory local presence on the affected endpoint - remote network exploitation is not possible - which confines realistic risk to scenarios of insider access, prior foothold, or multi-user/shared Dell workstations. Impact is limited to confidentiality (information disclosure) with no integrity or availability effect.

This is a moderate-severity, local-access information disclosure flaw whose signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 6.2) establishes that exploitation requires local access to the system but no authentication or user interaction, with high confidentiality impact and no integrity or availability impact - matching the CWE-321 (hard-coded cryptographic key) root cause, where any party able to read the key or key-protected data locally can decrypt it. No EPSS score, CISA KEV listing, SSVC decision, or public POC was provided in the input, so there is no evidence of active or probable exploitation; this reads as a low-urgency patch-on-cycle item rather than an emergency. The AV:L requirement is the dominant limiting factor: an attacker must already have local presence on a Dell endpoint, which substantially narrows real-world risk despite the 'PR:N' (unauthenticated) metric. Note the common tension in hard-coded-key CVEs - the key is typically universal across all installs, so once extracted by one researcher it is effectively known everywhere, which can elevate practical risk beyond what the per-instance local vector implies; verify the nature of the protected data with Dell's advisory DSA-2026-378.

An attacker with local access to a Dell endpoint running Dell Command | Configure below 5.2.3.35 locates the hard-coded cryptographic key embedded in the product and uses it to decrypt sensitive data (such as stored configuration secrets or credentials) protected by that key. No authentication or user interaction is required once local access is obtained. No public exploit was identified at time of analysis, though a hard-coded key is typically trivial to recover via static analysis.