EUVD-2026-62521
GHSA-cjq3-rjjf-q2pv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local access with low-privilege account is the entry point; missing authorization allows scope escape to OS-level resources, warranting S:C and full C/I/A impact.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
AnalysisAI
Privilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to gain elevated system access by exploiting missing authorization checks. The vulnerability carries a CVSS 3.1 score of 8.8 with a scope change (S:C), indicating the privilege escalation extends beyond the DCU process itself - likely to OS-level or other system components. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have a local low-privileged account (standard user) on a Windows system where Dell Command Update prior to 5.7.1 is installed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.8 (High) is driven primarily by the scope change (S:C) and full confidentiality, integrity, and availability impact (C:H/I:H/A:H), despite the local attack vector (AV:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with an unprivileged local Windows account on a Dell machine running DCU prior to 5.7.1 invokes a DCU component or API that fails to verify the caller's authorization level, triggering a privileged operation - such as writing to protected system directories or executing code in a high-integrity process context - without requiring administrator credentials. No public POC has been identified, but the low attack complexity suggests the missing check is straightforward to locate and invoke via standard Windows process or IPC mechanisms. |
| Remediation | Upgrade Dell Command Update (DCU) to version 5.7.1 or later, as specified in Dell advisory DSA-2026-309 at https://www.dell.com/support/kbdoc/en-us/000501378/dsa-2026-309-security-update-for-dell-command-update-for-multiple-vulnerabilities. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately inventory all systems running Dell Command Update versions prior to 5.7.1 and implement compensating controls (restrict DCU execution to administrative users, disable DCU if operationally feasible, enable privilege escalation monitoring). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Dell Command Update Dcu
View allElevation of privileges in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a low-privileged local att
Incorrect Default Permissions in Dell Command Update (DCU) exposes a local privilege escalation path on all versions pri
Elevation of privilege via deserialization of untrusted data affects Dell Command Update (DCU) versions prior to 5.7.1 o
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 enables a low-privileged local attacker to f
Missing Authorization in Dell Command Update (DCU) versions prior to 5.7.1 permits a low-privileged local user to invoke
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a local low-privileged atta
Local privilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a low-privileged local attacker t
XML External Entity injection in Dell Command Update (DCU) versions prior to 5.7.1 enables a local attacker with low-pri
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to ga
Dell Command Update (DCU) versions prior to 5.7.1 expose sensitive system information to low-privileged local users, con
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today