EUVD-2026-62511
GHSA-m4w4-mqf8-hj3h
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local attack vector and low-privilege requirement confirmed by description; C:H reflects vendor-characterized sensitive system data exposure; no integrity or availability impact applies.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell Command Update (DCU), versions prior to 5.7.1, contain an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
AnalysisAI
Dell Command Update (DCU) versions prior to 5.7.1 expose sensitive system information to low-privileged local users, confirmed via Dell Security Advisory DSA-2026-309. The CVSS vector (AV:L/AC:L/PR:L/UI:N/C:H) indicates that a standard local account with no elevated rights and no user interaction is sufficient to trigger high-confidentiality-impact disclosure - potentially exposing hardware identifiers, system configuration details, or other privileged data handled by the update utility. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) describes a class of flaw in which an application surfaces data - such as internal system state, device identifiers, or configuration secrets - to a principal outside the intended trust boundary. Dell Command Update is a Windows-based driver and firmware management utility pre-installed on Dell commercial and consumer hardware, running with elevated system-level access to enumerate and update device components. Because DCU operates with privileged access to hardware telemetry and system state, any leakage of that data to a standard OS user constitutes a meaningful trust boundary violation. The affected scope, per CPE cpe:2.3:a:dell:dell_command_update_(dcu):*:*:*:*:*:*:*:*, covers all DCU releases up to but not including 5.7.1.
RemediationAI
Upgrade Dell Command Update to version 5.7.1 or later, which is the vendor-confirmed fix per Dell Security Advisory DSA-2026-309 at https://www.dell.com/support/kbdoc/en-us/000501378/dsa-2026-309-security-update-for-dell-command-update-for-multiple-vulnerabilities. DCU typically supports self-updating; administrators can also push the update via Dell SupportAssist for Business PCs or endpoint management tooling. If immediate patching is not feasible, restrict interactive local logon rights on affected systems to only necessary personnel, reducing the pool of accounts that could reach the vulnerable data path. Additionally, audit local group membership to ensure no unintended standard-user accounts have session access on high-value or shared machines running DCU. Restricting local access is a compensating control only - it reduces exposure but does not eliminate the underlying vulnerability.
More in Dell Command Update Dcu
View allPrivilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to gain
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 enables a low-privileged local attacker to f
Elevation of privilege via deserialization of untrusted data affects Dell Command Update (DCU) versions prior to 5.7.1 o
Incorrect Default Permissions in Dell Command Update (DCU) exposes a local privilege escalation path on all versions pri
Elevation of privileges in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a low-privileged local att
Missing Authorization in Dell Command Update (DCU) versions prior to 5.7.1 permits a low-privileged local user to invoke
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a local low-privileged atta
Local privilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a low-privileged local attacker t
XML External Entity injection in Dell Command Update (DCU) versions prior to 5.7.1 enables a local attacker with low-pri
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to ga
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today