Dell RCC CVE-2026-56792

Exploitation requires local access to a device running Dell Rugged Control Center (RCC) at a version prior to 5.2.206, plus an existing low-privileged local account on that host (PR:L, AV:L). No user interaction is required (UI:N) and attack complexity is low (AC:L), but the flaw cannot be reached remotely - the attacker must already have a foothold on the rugged laptop/tablet. Practical exposure is limited to environments where RCC is installed and where untrusted or multiple users share the device; single-user personal devices offer little escalation value beyond an attacker who already controls the account.

Real-world risk is modest. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 4.4) requires local access and pre-existing low privileges, which caps blast radius to a user who is already on the host. There is no EPSS score, no CISA KEV listing, and no public POC identified at time of analysis - all three signals point to no known exploitation and low near-term likelihood of mass exploitation. Note a data conflict worth flagging: the description explicitly states 'Improper Authorization' and 'Elevation of Privileges,' yet the assigned CWE is CWE-287 (Improper Authentication) and the scored impact is only C:L/I:L/A:N. A genuine local privilege escalation typically warrants higher integrity/availability impact (the sibling advisory CVE-2026-81473 in the same DSA scored I:H/A:H), so the published 4.4 may understate the true impact - verify the exact escalation outcome with Dell. Priority: low-to-moderate, and only for fleets that actually run Dell Rugged Control Center on shared or multi-user rugged devices; it is a local post-compromise escalation primitive, not an internet-facing threat.

An attacker who already has a low-privileged local account on a Dell rugged laptop or tablet running RCC prior to 5.2.206 invokes an RCC function that fails to properly check authorization, and thereby elevates their privileges on the device. No user interaction is required and attack complexity is low, but local access and an existing foothold are prerequisites. No public exploit code has been identified at time of analysis.