EUVD-2026-88310
GHSA-gfqq-cvw7-p496
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged account on collector host
-
ExploitLocate hard-coded password in Collector binary/config
-
ExecutionUse credential to access protected data
-
ImpactExfiltrate exposed sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication No hard-coded passwords
MITRE ATT&CK
1 technique across 1 tactic: Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access to a host running Dell Live Optics Collector prior to version 27.2.13.310, an existing low-privileged account (PR:L), and user interaction (UI:R). The attacker must be able to read the application's embedded hard-coded password. Limiting factors: no network vector (AV:L), no privilege escalation or integrity/availability compromise beyond limited I:L, and the requirement that the Collector already be installed and in use on the target host - this is not exploitable remotely or against a default installation without prior local foothold. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N, base 5.6) describes a genuinely constrained flaw: exploitation requires LOCAL access, an already-authenticated low-privileged account (PR:L), and user interaction (UI:R). This is a local information-exposure issue via a hard-coded password (CWE-259), not a remotely exploitable RCE. No EPSS score, no CISA KEV listing, and no public POC were provided, so all signals point to LOW real-world urgency despite the HIGH confidentiality impact (C:H). There is no SSVC data supplied. The one point of tension worth noting: the input Tags include 'Authentication Bypass,' which conflicts with both the CWE (CWE-259 Use of Hard-coded Password) and the stated impact (information exposure, not a bypass of authentication) - the vector shows PR:L (attacker is already authenticated), so 'Authentication Bypass' is a mislabel rather than a confirmed capability. This is a real-but-low-priority patch-management item, appropriate for routine remediation cycles rather than emergency response. |
| Exploit ScenarioDerived | A low-privileged user already on a host where the Dell Live Optics Collector is installed reads or extracts the hard-coded password embedded in the application, then uses it to access sensitive data or credentials the collector protects, resulting in information exposure. Exploitation requires local access plus user interaction and yields high confidentiality impact but no direct code execution. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Dell Live Optics Collector versions prior to 27.2.13.310 ship with a hard-coded password (CWE-259) that a locally present, low-privileged attacker can recover and abuse to expose sensitive information. Exploitation is constrained: it requires local access to a host where the Collector is installed, an existing low-privileged account (PR:L), and user interaction (UI:R), yielding high confidentiality impact but only limited integrity impact and no availability impact (CVSS 3.1 base 5.6). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; Dell has published fix version 27.2.13.310 in advisory DSA-2026-339.
RemediationAI
Vendor-released patch: upgrade Dell Live Optics Collector to version 27.2.13.310 or later, as documented in Dell advisory DSA-2026-339 (https://www.dell.com/support/kbdoc/en-us/000514560/dsa-2026-339-security-update-for-dell-live-optics-collector); this is the definitive fix and replaces the embedded credential with appropriately managed secret handling. If the upgrade cannot be applied immediately, the practical compensating controls are host-side: tighten filesystem ACLs so the Collector installation and configuration directories are readable only by the service account and administrators, which directly blocks the low-privileged read path this flaw depends on - the trade-off is that broad local read access for support and troubleshooting workflows must be re-scoped. In parallel, reduce the number of accounts with interactive local logon rights on hosts running the Collector, since PR:L is a prerequisite, and monitor/invalidate any credentials that may have been derived from the embedded password, accepting that until 27.2.13.310 is installed the secret remains static and cannot be rotated by configuration alone. There is no vendor-published workaround that eliminates the flaw without upgrading; network controls do not mitigate it because the attack vector is local (AV:L).
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-259 'Use of Hard-coded Password' defect in Dell Live Optics Collector, a host-installed telemetry/data-collection agent used to gather storage, compute, and performance inventory from customer environments. Because the credential is embedded in the application rather than generated per installation or stored in an OS-protected secret store, anyone who can read the installed Collector files (or otherwise extract the embedded secret) obtains a reusable password. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N confirms this is a local-only attack path with low attack complexity, requiring the attacker to already hold a low-privileged account on the host and some form of user interaction before the credential can be leveraged. The impact profile - high confidentiality loss, limited integrity loss, unchanged scope and no availability effect - is consistent with credential disclosure granting read-oriented access to data or services associated with the Collector rather than full system takeover. The CPE cpe:2.3:a:dell:live_optics_collector:*:*:*:*:*:*:*:* covers all releases below the fixed build, so version identification relative to 27.2.13.310 is the primary exposure test. No exploitation has been confirmed as active (the CVE is not in CISA KEV) and no public proof-of-concept has been identified at time of analysis.
Know when Live Optics Collector gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Local access with an existing low-privileged account and user interaction to reach the hard-coded credential; high confidentiality exposure, minimal integrity, no availability impact.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
1DescriptionCVE.org
Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB