EUVD-2026-84040
GHSA-3wfr-97mq-2wmf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged access to host
-
ExploitLocate resource with incorrect default permissions
-
ExecutionRead sensitive out-of-band management data
-
ImpactDisclose confidential information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Default permission hardening
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires interactive or local low-privileged access to a Windows host that has Dell Command | Intel vPro Out of Band installed at a version prior to 4.7.2; the vulnerable default permissions (CWE-276) on the product's installed files, directories, registry keys, or objects must be present as shipped. Limiting factors: no remote vector (AV:L), the attacker must already possess a valid low-privilege account on the machine (PR:L), and impact is confined to reading data (no integrity or availability effect), which substantially narrows real-world risk versus the raw score. |
| Impact | This is a genuine but modest-severity issue best treated as routine patch-cycle work rather than an emergency. The CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) is internally consistent with the CWE-276 Incorrect Default Permissions weakness and the description: exploitation requires prior local access as a low-privileged user, and impact is confidentiality-only (C:H, with I:N/A:N - no integrity or availability effect). All signals agree it is a local information-disclosure flaw, not a remote or code-execution one. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation is neither confirmed nor known to be automated; the local attack vector plus a low-privilege prerequisite further caps real-world urgency. The 'Privilege Escalation' tag conflicts with the CVSS impact metrics (I:N means no integrity gain), so this should be read as data disclosure, not EoP. Net: a real, vendor-confirmed vulnerability with an available fix, but a lower priority than any network-reachable or actively-exploited issue. |
| Exploit ScenarioDerived | A low-privileged user already logged into a Windows endpoint that has Dell Command | Intel vPro Out of Band (below 4.7.2) installed abuses overly permissive default file/registry/object ACLs to read sensitive data (such as out-of-band management configuration or credentials) they should not be able to access. No public exploit code was identified, and the local low-privilege requirement means the attacker must already have a foothold on the host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Local information disclosure in Dell Command | Intel vPro Out of Band versions prior to 4.7.2 lets an authenticated, low-privileged user on a Windows host read data that should have been restricted, because the product ships files, directories, registry keys, or objects with overly permissive default access controls (CWE-276). Per the vendor's own advisory the impact is limited to confidentiality - no integrity or availability effect - and the vector requires local access plus a valid low-privilege account (AV:L/PR:L/UI:N), which is why it scores a moderate 5.5. No KEV listing or public exploit code was identified at time of analysis, and no public exploit has been identified; real-world risk is confined to hosts where an attacker already has a foothold, so this is routine patch-cycle work rather than an emergency.
RemediationAI
Vendor-released patch: upgrade Dell Command | Intel vPro Out of Band to version 4.7.2 or later, available through the Dell support page referenced in DSA-2026-377 (https://www.dell.com/support/kbdoc/en-us/000502470/dsa-2026-377-security-update-for-dell-command-intel-vpro-out-of-band-for-an-incorrect-default-permissions-vulnerability); because the flaw is in shipped default permissions rather than code logic, an in-place upgrade is required and simply reinstalling an older build will not correct the ACLs. Where immediate upgrade is not possible, compensating controls are limited because the exposure is local and the attacker must already hold an account on the endpoint: temporarily remove or tightly restrict local interactive logon for non-administrative users on systems running the affected tool, and audit and manually tighten ACLs on the product's installation directory, its configuration and log files, and its associated registry keys using icacls/registry ACL tooling - noting the trade-off that over-restricting these objects can break the tool's own service or management operations and may generate support issues. Additional practical measures include monitoring for unexpected reads of the product's directories, limiting which endpoints have the tool installed at all, and treating any host where an untrusted local user has executed code as potentially having leaked the configuration data the permissions were meant to protect; there is no network-side mitigation because the vector is purely local.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-276 (Incorrect Default Permissions): rather than a memory-safety or injection flaw, the installer or first-run configuration grants wider-than-intended access to objects it creates - typically installation directories, configuration files, log files, or the registry keys that Dell Command | Intel vPro Out of Band uses to manage Intel vPro/AMT out-of-band provisioning on managed Windows endpoints. Because those objects persist with permissive ACLs after installation, any local user who can log on to the machine can read their contents, exposing whatever sensitive material they hold (for example provisioning credentials, host or AMT configuration details, or inventory data). The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms a local attack path (AV:L), low complexity with no user interaction, and requires the attacker to already hold low privileges (PR:L), so it is not remotely reachable and cannot be chained to privilege escalation directly through this vector. Scope is unchanged (S:U) and only confidentiality is scored high (C:H), with no integrity or availability impact. The CPE cpe:2.3:a:dell:command_|_intel_vpro_out_of_band:*:*:*:*:*:*:*:* uses a version wildcard, consistent with the advisory's 'versions prior to 4.7.2' statement covering the entire earlier release line.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local access to an installed Windows utility with an existing low-privilege account (AV:L/PR:L), no user interaction, and confidentiality-only disclosure (C:H, I:N, A:N).
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
1DescriptionCVE.org
Dell Command | Intel vPro Out of Band, versions prior to 4.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB