EUVD-2026-62499
GHSA-pc64-jqmm-r5fc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Primary rating from Vendor (dell) · only source for this CVE.
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell Command Update (DCU), versions prior to 5.7.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
AnalysisAI
Local privilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a low-privileged local attacker to elevate their access by exploiting improper symbolic or hard link resolution (CWE-59) during DCU's file operations. Because DCU routinely executes with elevated system privileges to install drivers and firmware, an attacker who can plant a crafted link at a path DCU resolves can redirect those privileged file operations to arbitrary protected locations, achieving integrity impact rated High. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; Dell has released a fix in version 5.7.1 via advisory DSA-2026-309.
More in Dell Command Update Dcu
View allPrivilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to gain
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 enables a low-privileged local attacker to f
Elevation of privilege via deserialization of untrusted data affects Dell Command Update (DCU) versions prior to 5.7.1 o
Incorrect Default Permissions in Dell Command Update (DCU) exposes a local privilege escalation path on all versions pri
Elevation of privileges in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a low-privileged local att
Missing Authorization in Dell Command Update (DCU) versions prior to 5.7.1 permits a low-privileged local user to invoke
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a local low-privileged atta
XML External Entity injection in Dell Command Update (DCU) versions prior to 5.7.1 enables a local attacker with low-pri
Dell Command Update (DCU) versions prior to 5.7.1 expose sensitive system information to low-privileged local users, con
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to ga
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today