EUVD-2026-84051
GHSA-m9xq-j7q7-h7v8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local account on host
-
ExploitLocate suite files with weak default permissions
-
ExecutionRead sensitive data outside privilege level
-
ImpactExfiltrate disclosed information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Default permission hardening
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an attacker to already have a low-privileged, authenticated local session on the Windows host where Dell Command | Integration Suite for System Center (a version prior to 6.7.2) is installed. Exploitation depends on the product's incorrect default file/directory permissions (CWE-276) granting read access to sensitive data for accounts that should not have it; no remote vector, no user interaction, and no elevated privileges are needed beyond the initial local foothold. Limiting factors: the flaw is not remotely reachable, cannot be triggered without valid local access, affects only the confined population of hosts running this SCCM add-on, and yields disclosure only - no code execution, modification, or availability impact. |
| Impact | This is a genuine but modest-priority issue. The Dell-provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) is internally consistent with the description: local access, low privilege, no user interaction, high confidentiality impact only. There is no EPSS score, no CISA KEV listing, and no public exploit code, so the correct status is no public exploit identified at time of analysis. No SSVC decision block was provided. The signals do not conflict - every source (description, CWE-276, CVSS vector) agrees this is a local, authenticated information-disclosure flaw, not a remote or wormable one. It is therefore not an emergency-patch priority; it ranks as routine remediation. The single limiting caveat is that the exact mechanism (which files or directories carry the weak default permissions, and what sensitive data they expose) is not disclosed in the Dell advisory abstract, so the concrete blast radius cannot be independently verified. |
| Exploit ScenarioDerived | A low-privileged user already logged into a Windows management host running Dell Command | Integration Suite for System Center abuses the product's overly permissive default file/directory ACLs to read configuration or credential-bearing files they should not be able to access. No public exploit code exists, and the attack requires prior local, authenticated access rather than remote reach. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Local information disclosure in Dell Command | Integration Suite for System Center (versions prior to 6.7.2) allows a low-privileged, authenticated local user to read sensitive data that should not be accessible to that account. The root cause is incorrect default file or directory permissions (CWE-276) shipped with the SCCM add-on, which grant broader read access than intended. Exploitation requires an existing local session on the Windows host running the affected software - there is no remote vector, no user interaction, and no privilege escalation needed beyond the initial foothold - and the result is confidentiality impact only, with no code execution, data modification, or availability impact. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; the assessed CVSS 3.1 base score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
RemediationAI
Upgrade Dell Command | Integration Suite for System Center to version 6.7.2 or later - that is the vendor-released fix identified in advisory DSA-2026-409 (https://www.dell.com/support/kbdoc/en-us/000506922/dsa-2026-409-security-update-for-dell-command-integration-suite-for-system-center-for-an-incorrect-default-permissions-vulnerability), and no patched release other than 6.7.2 should be assumed to contain the corrected default ACLs. Where the upgrade cannot be scheduled immediately, the practical compensating control is to remediate the permissions directly: audit the ACLs on the product's installation and data directories, configuration stores, and any driver or catalog repositories it creates, and remove inherited or explicit read access granted to unprivileged local groups (for example, by tightening ACLs so that only Administrators and the account under which the suite runs retain access). The trade-off is that tightening ACLs can break non-elevated console or PowerShell workflows that previously relied on those read paths, so validate the suite's operations after any change. A second, narrower control is to restrict interactive logon rights on hosts running the suite so that only trusted administrators can obtain a local session, which eliminates the required PR:L foothold; the trade-off is increased operational friction on site servers and admin workstations. Standard local monitoring for unexpected reads of the installation directory by non-administrative accounts can help detect attempted exploitation, and because the vulnerability is not remotely reachable, network-level controls are not an effective mitigation. Confirm the exact fixed build and any additional guidance against Dell's advisory before closing out remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-276 (Incorrect Default Permissions) describes software that installs files, directories, registry keys, or configuration artifacts with weaker access controls than the security model requires. In this case the affected component is Dell Command | Integration Suite for System Center, a Dell add-on that integrates with Microsoft System Center Configuration Manager (SCCM/MECM) to provide driver, BIOS, and firmware management workflows. Such suites typically install management consoles, PowerShell modules, driver catalogs, task sequences, credentials, and configuration data on the site server or admin workstation, and those artifacts are stored under installation paths whose ACLs are set at install time. Because the default ACLs are too permissive, a standard non-administrative local user inheriting access to those paths can read content intended only for administrators or service accounts. The vulnerability is local-only per the CVSS vector (AV:L) and requires low privileges (PR:L), so the attack surface is the file system of the host rather than any network service. The CPE entry cpe:2.3:a:dell:command_|_integration_suite_for_system_center:*:*:*:*:*:*:*:* is version-agnostic in the supplied data, so version scoping must come from the advisory text: all releases prior to 6.7.2. The independent assessment confirms the prerequisites - an existing low-privileged authenticated local session on a Windows host with an affected version installed - and characterizes the impact as disclosure only, with no modification or denial-of-service component, and no remote reachability.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local authenticated low-priv user exploits weak default permissions with no interaction; impact is confidentiality-only, hence C:H and I:N/A:N, matching the vendor vector.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
1DescriptionCVE.org
Dell Command | Integration Suite for System Center, versions prior to 6.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB