EUVD-2026-93780
GHSA-x792-vcc4-26gx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain high-privilege MITM network position
-
DeliveryIntercept Dell System Update traffic
-
ExploitBypass improper certificate validation
-
ExecutionDeliver forged update payload
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V12 - Secure Communication Certificate validation
|
| Exploitation Conditions | Exploitation requires the attacker to (1) hold high privileges (PR:H per CVSS and the vendor's 'high privileged attacker' wording), (2) occupy a man-in-the-middle position on the network path used by Dell System Update to fetch updates - the Improper Certificate Validation (CWE-295) means the client accepts a forged/invalid server certificate - and (3) have a user initiate or accept an update (UI:R). Affected scope is Dell System Update versions prior to 2.3.0.0. Limiting factors that reduce realistic risk: the high attack complexity of establishing the MITM/certificate-spoofing condition, the pre-existing high privilege requirement, and the dependency on user-initiated update activity; none of these are default, passive, or fully remote-unauthenticated. |
| Impact | This is a genuinely High-severity flaw (CVSS 7.6) but with substantial exploitation barriers that temper real-world urgency. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:H/UI:R stacks three mitigating conditions: high attack complexity (AC:H, consistent with needing a man-in-the-middle position on update traffic for an Improper Certificate Validation / CWE-295 flaw), high privileges already required (PR:H), and user interaction required (UI:R, i.e., a victim must initiate/accept an update). Offsetting these, the scope is Changed (S:C) and all three impacts are High (C:H/I:H/A:H), reflecting full system compromise via remote code execution through the update mechanism. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: this warrants patching on Dell endpoints but is not a drop-everything emergency - the combination AC:H + PR:H + UI:R makes opportunistic mass exploitation unlikely, pointing to targeted scenarios (e.g., an attacker already privileged on a network intercepting update sessions) rather than widespread attacks. Note the input Tags label this 'Information Disclosure,' which conflicts with the stated impact of Remote execution - treat the RCE framing (per CWE-295 and the vendor description) as authoritative. |
| Exploit ScenarioDerived | An attacker with high privileges and a man-in-the-middle position on the network intercepts Dell System Update's download of an update package. Because the client fails to properly validate the server certificate (CWE-295), the attacker presents a forged update that the client accepts, and when the user initiates the update it executes attacker-controlled code with the elevated privileges of the update service. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Improper certificate validation in Dell System Update (DSU) versions prior to 2.3.0.0 lets an authenticated, high-privileged attacker who can occupy a man-in-the-middle position on the update path present DSU with a forged TLS certificate and deliver a malicious update payload, which the vendor describes as leading to remote execution on the affected host. The barriers are substantial: the CVSS vector (AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) requires high privileges, a high-complexity MITM/certificate-spoofing condition, and a user initiating or accepting an update, and the scope change (S:C) reflects impact escaping the update client into the payload it installs. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so despite the genuinely High CVSS 7.6 base score, real-world urgency is tempered by these preconditions rather than driven by observed exploitation.
RemediationAI
Vendor-released patch: Dell System Update 2.3.0.0 - upgrade every DSU installation from versions prior to 2.3.0.0 to 2.3.0.0 or later, and confirm the exact remediation matrix in Dell advisory DSA-2026-324 (https://www.dell.com/support/kbdoc/en-us/000515843/dsa-2026-324-security-update-for-dell-system-update-dsu-vulnerabilities) since DSU is frequently bundled into imaging, deployment, and management suites that may need separate updating. Because the flaw is a broken certificate check on the update fetch path, useful compensating controls while patching lag include forcing DSU catalog and package retrieval through an internally controlled mirror or egress proxy that terminates TLS with a pinned, trusted certificate, which restores validation at the network layer at the cost of running and maintaining that mirror and accepting some delay in catalog freshness; restricting outbound HTTPS from managed endpoints to only that proxy so DSU cannot fall back to directly contacting vendor repositories, with the trade-off that other legitimate update traffic may break and must be allow-listed; and verifying downloaded catalogs/packages against out-of-band signature or hash data before installation, which adds a manual or scripted verification step and slows deployment. Also run DSU with the lowest privileges feasible and require explicit human confirmation of the update source and content, since UI:R means a user action is part of the exploit path and a reviewed, trusted-source-only workflow removes the attacker's ability to complete the chain, albeit at the cost of additional operator effort. No vendor workaround that disables certificate bypass behavior is identified in the available data, so upgrade remains the primary fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-295, Improper Certificate Validation. Dell System Update (DSU) is a command-line/console utility used on Dell client and server hardware to retrieve catalogs and apply BIOS, firmware, and driver updates, typically by connecting over HTTPS to Dell's online repositories; that update channel is effectively a software-supply-chain trust boundary, which is why TLS server certificate validation inside DSU is security-critical. In an affected build, the client fails to properly validate the certificate chain or hostname of the update server, so an attacker already positioned on the network path can answer the request with a self-signed or mismatched certificate and serve attacker-controlled packages that DSU then treats as legitimate. Because the assessment records S:C (scope changed), the consequence is not confined to the update client itself: the injected payload executes with the privileges and context of the updating process, matching the vendor's statement that exploitation leads to remote execution. The CPE cpe:2.3:a:dell:system_update:*:*:*:*:*:*:*:* uses an unrestricted version wildcard, indicating all releases below the fixed version are in scope across the platforms where DSU runs, and the supplied tag set ('Information Disclosure', 'Dell', 'System Update') understates the vendor-stated remote-execution outcome, so RCE should be treated as the primary risk rather than read as a disclosure-only issue. Exploitation prerequisites remain non-trivial: high privileges (PR:H), high attack complexity (AC:H) to establish the MITM and certificate substitution, and required user interaction (UI:R) to trigger the update.
Know when System Update gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
AV:N and AC:H reflect a network MITM/certificate-spoofing precondition, PR:H and UI:R match the privileged attacker and user-triggered update, and S:C with C/I/A:H captures RCE escaping the update client to the OS.
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
Executive ViewAI
Dell System Update (DSU), the utility used to distribute firmware and driver packages across Dell server estates, contains a TLS certificate-validation flaw in releases prior to 2.3.0.0 that can let an attacker on the update network path substitute a malicious payload and achieve remote execution on the managed host. Because DSU runs with elevated privilege on servers, a single successful compromise could push a tampered update across an entire managed fleet, putting infrastructure integrity, availability, and configuration trust at risk. Leadership should note, however, that the attack requires an already high-privileged actor, a man-in-the-middle position on the update path, and a user accepting an update, and no public exploit has been identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: disable automatic update checks and require manual, out-of-band updates from verified local media; restrict DSU update traffic to trusted networks and approved Dell endpoints; apply independent TLS inspection and certificate pinning on the update path; minimize accounts with privileges to trigger or approve updates; and monitor for anomalous update client activity or unexpected payload changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in System Update
View allLenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allo
Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the
A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ab
Path traversal in Dell System Update (DSU) versions prior to 2.3.0.0 allows an unauthenticated remote attacker to escape
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during
Privilege escalation in Dell System Update versions prior to 2.3.0.0 lets a low-privileged local attacker abuse an incor
Elevation of privilege in Dell System Update (DSU) versions prior to 2.3.0.0 allows an authenticated, low-privileged loc
Local privilege escalation and code execution in Dell System Update (DSU) versions prior to 2.3.0.0 allows an authentica
An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local a
MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contai
A denial of service vulnerability was reported in Lenovo System Update versions prior to 5.07.0088 that could allow conf
A denial of service vulnerability was reported in Lenovo System Update before version 5.07.0084 that could allow service
Exploit-DB