Alienware Command Center EUVD-2026-115459

Dell Alienware Command Center (a version prior to 6.14.54.0) must be installed on the victim's machine so that its custom URL scheme handler is registered. Exploitation is not fully unauthenticated: the CVSS vector specifies PR:L, so a low-privileged context is required, and UI:R means the victim must actively interact - typically opening or clicking an attacker-crafted link that invokes the vulnerable custom URL scheme. These limiting factors (required user interaction, required low-level privilege, and the need for AWCC to be present) substantially constrain real-world exploitation beyond what the network attack vector alone suggests. The precise conditions under which the authorization check is bypassed are not described in the available sources.

This is a low-severity issue by every available signal, and the signals are consistent rather than conflicting. The vendor CVSS base score is 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N): although the attack vector is network, exploitation requires low-level privileges (PR:L), requires victim user interaction (UI:R), and yields only a limited confidentiality impact with no integrity or availability impact (C:L/I:N/A:N) - consistent with a Client-Side Request Forgery / information-disclosure outcome rather than code execution. The vuln.today decision label is 'monitor', the lowest urgency tier, which aligns with the low base score. No EPSS probability was supplied, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit reference appears in the input, so exploitation status is 'no public exploit identified at time of analysis.' The one missing-but-relevant datum is EPSS, but its absence does not change the picture: nothing here elevates this above a routine patch-on-schedule item. This is a genuinely low-priority, high-CVSS-it-is-not case - treat as a maintenance update.

An attacker crafts a web page or message containing a link that invokes Dell Alienware Command Center's custom URL scheme, and lures a user who already has AWCC installed into opening it (UI:R). Because the custom URL scheme handler performs improper authorization, the crafted invocation causes the client to issue a forged request, resulting in limited information disclosure. No public exploit or PoC is identified at time of analysis.