EUVD-2026-61204
GHSA-3j55-8x3w-q728
Severity by source
AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H
Local-only access (AV:L), race or setup timing required (AC:H), low-privilege account needed (PR:L), separate user trigger mandatory (UI:R); no confidentiality impact.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
Lifecycle Timeline
2DescriptionCVE.org
Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of Service and Elevation of Privileges.
AnalysisAI
Privilege escalation and denial of service in Dell Alienware Command Center (AWCC) versions prior to 6.14.20.0 are achievable by a local low-privileged attacker exploiting a link-following flaw in the application's privileged file access routines. The vulnerability allows an attacker to substitute a symbolic link or directory junction between the time AWCC resolves a filesystem path and the time it performs a privileged file operation, redirecting that operation to an arbitrary location. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local, authenticated account with low privileges (PR:L per CVSS) on a Windows system running Dell Alienware Command Center versions prior to 6.14.20.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.0 accurately reflects a constrained attack profile: local access only (AV:L), high complexity requiring precise timing or setup (AC:H), a low-privileged but authenticated attacker (PR:L), and a mandatory user interaction trigger (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is upgrading Dell Alienware Command Center to version 6.14.20.0 or later, as documented in Dell advisory DSA-2026-334, available at https://www.dell.com/support/kbdoc/en-us/000501384/dsa-2026-334-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57
The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerabili
The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabi
The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerabili
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection
Same weakness CWE-272 – Least Privilege Violation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today