EUVD-2026-86407
GHSA-9xwc-2w5g-qwf2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged local user
-
ExploitLocate mis-permissioned Trusted Device Client resource
-
ExecutionWrite to weakly-ACL'd file or key
-
ImpactTamper with client integrity/attestation data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Permission assignment review
|
| Exploitation Conditions | Exploitation requires local, interactive (or session) access to a Windows endpoint running Dell Trusted Device Client at a version prior to 8.1.359.0, plus a low-privileged user account on that host (PR:L). The core precondition is the CWE-732 misconfiguration itself - a critical resource (file, directory, registry key, or service) shipped with permissions that allow standard users write/modify access. Limiting factors: no remote vector (AV:L), no exploitation without an existing local account, and no code execution or availability impact claimed (A:N); the realistic outcome is tampering with trusted-device client data/state, not remote compromise. |
| Impact | The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 7.1) describes a locally-exploitable flaw requiring an already-authenticated low-privileged user on the host - not a remote or unauthenticated exposure. There is no EPSS score, no CISA KEV listing, and no public POC referenced, so exploitation status is 'no public exploit identified at time of analysis'; combined with the local attack vector this is a lower operational priority than the 7.1 score suggests, functioning primarily as a local privilege/data-integrity escalation rather than a mass-exploitable network bug. One notable inconsistency: the Dell/NVD description states impact as 'Information tampering' (an integrity outcome) while the CVSS vector asserts BOTH C:H and I:H - the confidentiality-high claim is not substantiated by the prose, so the true impact may be integrity-weighted with lesser confidentiality exposure; verify with Dell DSA-2026-408. No conflicting KEV/EPSS signals exist because none are present. |
| Exploit ScenarioDerived | A low-privileged user already logged into a Windows host running Dell Trusted Device Client locates a critical resource (file, registry key, or service object) that has been assigned overly permissive ACLs, then modifies its contents or configuration to tamper with trusted-device attestation data or client state. No public exploit code is referenced, and exploitation requires prior local access to the machine. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Incorrectly assigned permissions on critical resources shipped with Dell Trusted Device Client (all versions prior to 8.1.359.0) let a low-privileged local user write to or modify files, directories, registry keys, or service configuration belonging to the agent, enabling tampering with trusted-device state and, per the vendor vector, disclosure of sensitive data (CVSS 3.1 base 7.1, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Exploitation is strictly local: it requires an existing interactive or session-level account on the Windows endpoint and the underlying CWE-732 misconfiguration; there is no remote or unauthenticated vector, and no code execution or availability impact is claimed. Our independent assessment narrows the confidentiality component to Low (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) and stresses that the realistic outcome is tampering with client data and configuration rather than host compromise. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; the vendor advisory is the only reference.
RemediationAI
The primary fix is to upgrade Dell Trusted Device Client to version 8.1.359.0 or later - Vendor-released patch: 8.1.359.0 - which corrects the permission assignment on the affected critical resource; deploy it through Dell Command | Update, your software distribution tooling, or the installer documented in Dell advisory DSA-2026-408 (https://www.dell.com/support/kbdoc/en-us/000506918/dsa-2026-408-security-update-for-dell-trusted-device-client-for-an-incorrect-permission-assignment-for-critical-resource-vulnerability). If the upgrade cannot be staged immediately, apply targeted compensating controls that directly address CWE-732 rather than generic hardening: enumerate the client's install directory, its ProgramData configuration/cache locations, and its service or driver registry keys, and tighten the ACLs so that only SYSTEM and Administrators have write/modify rights - trade-off: an overly aggressive ACL could break agent self-update or attestation logging, so validate on a pilot ring before broad rollout. Confirm no non-administrative group (Users, Authenticated Users, Everyone) holds Write, Modify, or Full Control on those paths. Where practical, restrict interactive local logon on high-value endpoints and ensure the agent service runs under a dedicated low-privilege or SYSTEM context with least privilege. Finally, monitor for unexpected modifications (file integrity monitoring and registry-change auditing on the client's paths) since tampering may precede or accompany other activity; no workaround fully substitutes for the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-732 (Incorrect Permission Assignment for Critical Resource) is a configuration flaw class in which a security-relevant file, folder, registry hive/key, named pipe, or service object is installed with an ACL that grants standard users write or modify rights they should never have. Dell Trusted Device Client is a Windows endpoint agent that establishes device trust and attestation on Dell commercial systems, which means its on-disk configuration, cached attestation/identity material, and service state are security-critical: if a low-privileged user can alter them, the client's reported trust posture can be manipulated. The CPE cpe:2.3:a:dell:trusted_device_client:*:*:*:*:*:*:*:* confirms the affected component is the client application itself across versions, with 8.1.359.0 as the first fixed release per the vendor description. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N places the issue squarely in the local-privileged-user space - the attacker already holds an account on the host, so this is best understood as a host-hardening and integrity bypass issue rather than an initial-access vulnerability. Our independent assessment retains the High integrity impact but lowers confidentiality to Low, reflecting that the misconfiguration's core consequence is modifying trusted-device resources, with data exposure a secondary and less certain effect.
Know when Trusted Device Client gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Local low-privileged access to a mis-permissioned resource justifies AV:L/PR:L/AC:L; description asserts tampering so I:H, but confidentiality is downgraded to C:L since the prose does not support C:H.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.
Executive ViewAI
Dell Trusted Device Client, deployed across the Windows endpoint fleet to provide device-trust attestation, ships with permission misconfigurations that allow any user already logged into a machine to modify the agent's files, directories, registry keys, and service configuration in all versions prior to 8.1.359.0. The practical effect is that someone with ordinary local credentials, or an attacker who has already landed on an endpoint, can undermine the integrity of the device-trust signals the organization depends on for conditional access and compliance reporting, without remote access or elevated rights. Leadership should treat this as a risk to a security control rather than a single application, because quiet degradation of trusted-device state weakens access decisions across the entire estate.
No vendor-released patch identified at time of analysis. Interim mitigations: tighten NTFS and registry ACLs on the Dell Trusted Device Client install directories, service configuration, and registry keys so only SYSTEM and Administrators retain write access; restrict local interactive and session-level accounts on endpoints running the agent; deploy file-integrity and registry-monitoring alerts for those paths and services; monitor device-trust and attestation telemetry for tampering, suppression, or missing signals; and enforce least privilege and application control to shrink the pool of local accounts able to exploit the misconfiguration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB