EUVD-2026-86401
GHSA-rpjr-64ph-wqh3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local account
-
DeliveryInvoke RCC privileged function
-
ExploitBypass improper authorization check
-
ExecutionTrigger required user interaction
-
ImpactElevate to administrative privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access to a Dell endpoint running Rugged Control Center (RCC) prior to version 5.2.206, with the attacker already holding a low-privileged local account (PR:L). Exploitation additionally depends on user interaction (UI:R per the CVSS vector). It cannot be performed remotely or unauthenticated (AV:L, no PR:N), which materially limits real-world exposure to scenarios where an attacker or malware already has a foothold on the specific rugged device; RCC is bundled with Dell rugged Latitude laptops/tablets, so only that installed base is affected. |
| Impact | CVSS 8.1 (High) is driven almost entirely by the AV:L/PR:L combination plus a scope change (S:C) and high integrity/availability impact - this is a local privilege-escalation flaw, NOT a remote-exploitable one. Attack vector is LOCAL and requires an already-authenticated low-privileged account (PR:L) plus user interaction (UI:R), so it cannot be triggered by an anonymous network attacker. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of active or automatable mass exploitation. Note a signal tension: the description characterizes the flaw as 'Improper Authorization' (mapping to CWE-285) while the record is tagged CWE-287 (Improper Authentication) - verify the true weakness class with Dell. The vendor-assigned vector also looks internally inconsistent for a local EoP: UI:R and S:C are unusual for a same-system privilege escalation and C:L understates a typical elevation-to-admin outcome (see assessed vector). Net: a real but bounded local-privilege-escalation issue best triaged as a routine patch on affected Dell rugged endpoints rather than an emergency, high-real-risk network exposure. |
| Exploit ScenarioDerived | A low-privileged user (or malware already running under a limited local account) on a Dell rugged laptop/tablet running RCC prior to 5.2.206 invokes the RCC component and, through an improper authorization check, performs an action reserved for a higher-privileged context, elevating to administrative privileges on the device. Because CVSS specifies UI:R, the chain likely requires a local user action to complete. No public proof-of-concept is identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Improper authorization in Dell Rugged Control Center (RCC) builds prior to 5.2.206 allows a low-privileged local user to escalate privileges on an affected rugged Dell endpoint. The vendor rates this CVSS 8.1 with a local attack vector, low privileges required, scope change, and high integrity and availability impact (AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H), meaning an attacker or malware must already hold a foothold on the specific rugged device - it is not remotely or unauthenticated exploitable. No public exploit code or confirmed active exploitation was identified at time of analysis, and Dell has released a fixed build (5.2.206) via advisory DSA-2026-410.
RemediationAI
Vendor-released patch: upgrade Dell Rugged Control Center to version 5.2.206 or later; Dell documents the update in its DSA-2026-410 advisory at https://www.dell.com/support/kbdoc/en-us/000506924/dsa-2026-410-security-update-for-dell-rugged-control-center-rcc-multiple-vulnerabilities, which must be reviewed in full because it addresses multiple RCC vulnerabilities. Where immediate upgrade of a rugged device is impractical, compensating controls should target the local privilege boundary that this flaw abuses: enforce least privilege so that only trusted administrators can log on to or run code on affected rugged endpoints, and audit for unnecessary low-privileged interactive accounts and local group memberships - the trade-off is reduced operational flexibility for shared or field-deployed devices. Application allowlisting and hardening of local process execution paths (for example, blocking untrusted binaries from launching from user-writable directories) can interrupt exploitation chains, at the cost of additional endpoint management overhead and possible friction with field tooling. If RCC functionality is not required on a given device, uninstalling or disabling the utility removes the attack surface entirely, with the obvious trade-off of losing rugged-specific hardware controls. Because exploitation requires an existing local foothold, monitoring for suspicious local privilege transitions and unauthorized modification of RCC-related files or services on rugged endpoints gives the best chance of detecting post-compromise activity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is tracked as CWE-287 (Improper Authentication) and described by the vendor as an Improper Authorization vulnerability, indicating that RCC fails to correctly validate the identity or privileges of the caller before performing a security-sensitive operation. The affected component is identified by the CPE cpe:2.3:a:dell:rugged_control_center_(rcc):*:*:*:*:*:*:*:*, i.e. the RCC endpoint utility that Dell ships with its rugged hardware line; because that utility typically runs with elevated rights while interacting with lower-privileged local users, a missing authorization check on an exposed interface creates a privilege boundary failure. The CVSS scope change (S:C) is characteristic of this class: the vulnerable component affects resources beyond its own security scope, so a low-privileged local process can drive privileged actions. Both the vendor vector and the assessment agree on AV:L/PR:L, confirming the attack surface is the local endpoint session rather than the network; the vendor vector additionally flags user interaction (UI:R), which slightly narrows exploitability compared with a fully unattended trigger. High integrity and availability impact indicate that a successful exploit can tamper with or disrupt the device's system state, not merely read data.
Know when Rugged Control Center Rcc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H
Local low-priv account elevating to admin gives full C/I/A:H on one system (S:U); UI:N since local EoP rarely needs interaction - diverges from Dell's UI:R/S:C/C:L.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
Executive ViewAI
Dell Rugged Control Center, the management software preinstalled on Dell rugged laptops and tablets used by field, industrial, and public-safety staff, contains an authorization flaw that lets an attacker who already has a foothold on the device elevate to higher privileges and tamper with or disrupt the system. Because exploitation requires local access to the specific hardened endpoint, this is a post-compromise escalation risk rather than a remote perimeter threat, but it can turn a minor malware infection or a shared-device misuse into full control of a field asset. Leadership should care because these devices often sit outside the corporate network in physically exposed environments, so containment options are limited once privilege escalation succeeds.
Apply vendor patch (RCC build 5.2.206 per Dell advisory DSA-2026-410). Until the upgrade is deployed, limit local user privileges on affected rugged endpoints, restrict software execution to known-good binaries, and monitor those devices closely for signs of local privilege escalation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB