EUVD-2026-93791
GHSA-69qr-6288-5gvw
Severity by source
AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Local foothold needed (AV:L/PR:L) with required interaction (UI:R); improper access control escalates across an authorization boundary (S:C) to full C/I/A impact.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
4DescriptionCVE.org
Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
Articles & Coverage 1
AnalysisAI
Elevation of privilege in Dell System Update (DSU) versions prior to 2.3.0.0 allows an authenticated, low-privileged local attacker to reach a privileged code path and operate at higher integrity than intended, stemming from an improper access control weakness (CWE-284, tagged by the reporter as an authentication bypass). Exploitation is conditional rather than drive-by: the attacker must already hold a local account on the endpoint (AV:L, PR:L) and a separate user interaction step (UI:R) is required to trigger the vulnerable path, so this is a post-foothold escalation scenario with no remote or network-reachable vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already have local, low-privileged access to a host with Dell System Update prior to version 2.3.0.0 installed (PR:L, AV:L), AND requires user interaction (UI:R) to trigger the privileged code path - these two factors materially limit real-world abuse to post-foothold scenarios and cannot be driven remotely or fully autonomously. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional priority, not a drive-by threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Dell System Update to version 2.3.0.0 or later, as documented in Dell advisory DSA-2026-324 (https://www.dell.com/support/kbdoc/en-us/000515843/dsa-2026-324-security-update-for-dell-system-update-dsu-vulnerabilities); verify the installed build via the DSU version command after upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all endpoints running Dell System Update versions prior to 2.3.0.0 and restrict local account access to only trusted users; enable enhanced monitoring for privilege escalation attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today