EUVD-2026-62509
GHSA-wwx5-c6f8-7jqf
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
TOCTOU exploitation requires winning a timing race, warranting AC:H over vendor's AC:L; all other metrics match the described local, low-privilege, user-triggered scenario.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
3DescriptionCVE.org
Dell Command Update (DCU), versions prior to 5.7.1, a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
AnalysisAI
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a local low-privileged attacker exploiting a Time-of-check Time-of-use (TOCTOU) race condition (CWE-367). The vulnerability allows an attacker who already has a local foothold on the system to manipulate a resource between the time it is checked and the time it is used by the update utility, resulting in full system compromise (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Technical ContextAI
Dell Command Update is a Windows-based utility that manages firmware, driver, and BIOS updates for Dell commercial and consumer PC platforms. The flaw is classified as CWE-367 (TOCTOU Race Condition), a class of vulnerability where a program checks the state of a resource and then uses it, but the resource's state can be altered by another thread or process during that window. In a privileged update context, this typically manifests as a writable path or resource (e.g., a staging directory, a named pipe, or a registry key) that DCU trusts after validation but before consumption. An attacker with low privilege can substitute a malicious payload into that resource during the race window, causing DCU's elevated process to act on attacker-controlled data. The CPE cpe:2.3:a:dell:dell_command_update_(dcu):*:*:*:*:*:*:*:* confirms all DCU application variants up to the fix version are affected.
RemediationAI
Upgrade Dell Command Update to version 5.7.1 or later, which contains the vendor-released fix per Dell advisory DSA-2026-309 (https://www.dell.com/support/kbdoc/en-us/000501378/dsa-2026-309-security-update-for-dell-command-update-for-multiple-vulnerabilities). DCU can typically be updated via Dell SupportAssist or by downloading directly from the Dell support portal. Where immediate patching is not possible, a compensating control is to restrict local interactive logon rights to only trusted administrators on affected systems, reducing the attacker population that could exploit the race window - note this does not eliminate the vulnerability if an insider or previously compromised account is the threat model. Additionally, disabling or restricting DCU's scheduled update tasks until patching is complete limits the user-interaction trigger surface, though this trades update automation for temporary risk reduction.
More in Dell Command Update Dcu
View allPrivilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to gain
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 enables a low-privileged local attacker to f
Elevation of privilege via deserialization of untrusted data affects Dell Command Update (DCU) versions prior to 5.7.1 o
Incorrect Default Permissions in Dell Command Update (DCU) exposes a local privilege escalation path on all versions pri
Elevation of privileges in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a low-privileged local att
Missing Authorization in Dell Command Update (DCU) versions prior to 5.7.1 permits a low-privileged local user to invoke
Local privilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a low-privileged local attacker t
XML External Entity injection in Dell Command Update (DCU) versions prior to 5.7.1 enables a local attacker with low-pri
Dell Command Update (DCU) versions prior to 5.7.1 expose sensitive system information to low-privileged local users, con
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to ga
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today