Monthly
Privilege elevation on Dell client endpoints that have Dell Command | Configure (DCC) installed at a version below 5.2.3.35, driven by improper handling of mixed encoding (CWE-175) that allows crafted, ambiguously encoded input to be processed in a way that yields elevated rights. Dell labels the flaw 9.8 with an AV:N/AC:L/PR:N/UI:N vector, but our independent assessment treats it as a local, low-privilege-triggered defect (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) because DCC is an optional local client-configuration utility rather than a network service and the advisory never identifies a remotely reachable interface - the input signals are sharply conflicting and must not be reconciled uncritically. There is no public exploit identified at time of analysis, EPSS is low at 0.27% (18th percentile), CISA SSVC records exploitation as none, and a vendor patch is available.
Privilege elevation on Dell client endpoints that have Dell Command | Configure (DCC) installed at a version below 5.2.3.35, driven by improper handling of mixed encoding (CWE-175) that allows crafted, ambiguously encoded input to be processed in a way that yields elevated rights. Dell labels the flaw 9.8 with an AV:N/AC:L/PR:N/UI:N vector, but our independent assessment treats it as a local, low-privilege-triggered defect (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) because DCC is an optional local client-configuration utility rather than a network service and the advisory never identifies a remotely reachable interface - the input signals are sharply conflicting and must not be reconciled uncritically. There is no public exploit identified at time of analysis, EPSS is low at 0.27% (18th percentile), CISA SSVC records exploitation as none, and a vendor patch is available.