EUVD-2026-62512
GHSA-4w8m-8vvx-gcw2
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Local-only vector and low-privilege requirement reflect a desktop utility authorization gap; UI:R constrains automation; full C/I/A consistent with DCU's system-level driver and firmware access.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.
AnalysisAI
Missing Authorization in Dell Command Update (DCU) versions prior to 5.7.1 permits a low-privileged local user to invoke protected application functions without adequate authorization checks, yielding full confidentiality, integrity, and availability impact on the vulnerable system. Rooted in CWE-862, the flaw bypasses expected access controls within the DCU client utility - a driver and firmware management tool deployed across Dell client hardware fleets. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an existing low-privileged local user session on the target system (PR:L per CVSS vector) and user interaction (UI:R), meaning the attack is not fully autonomous and depends on a triggering action within DCU. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H scores 7.3 (High), reflecting that while local access and user interaction constrain the attack surface significantly, successful exploitation yields complete confidentiality, integrity, and availability impact on the host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged local user on a Dell endpoint running DCU prior to 5.7.1 performs an action that triggers DCU's vulnerable code path - such as interacting with a UI component or invoking a DCU function that skips the authorization check. The missing gate allows the user to perform operations normally restricted to administrators, such as initiating arbitrary driver or BIOS updates, which could be leveraged to install malicious firmware or corrupt system state. … |
| Remediation | Upgrade Dell Command Update to version 5.7.1 or later, which resolves this vulnerability per Dell advisory DSA-2026-309 at https://www.dell.com/support/kbdoc/en-us/000501378/dsa-2026-309-security-update-for-dell-command-update-for-multiple-vulnerabilities. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Dell Command Update installations and identify systems running versions prior to 5.7.1 using your CMDB or endpoint management platform. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Dell Command Update Dcu
View allPrivilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to gain
Elevation of privileges in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a low-privileged local att
Incorrect Default Permissions in Dell Command Update (DCU) exposes a local privilege escalation path on all versions pri
Elevation of privilege via deserialization of untrusted data affects Dell Command Update (DCU) versions prior to 5.7.1 o
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 enables a low-privileged local attacker to f
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a local low-privileged atta
Local privilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a low-privileged local attacker t
XML External Entity injection in Dell Command Update (DCU) versions prior to 5.7.1 enables a local attacker with low-pri
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to ga
Dell Command Update (DCU) versions prior to 5.7.1 expose sensitive system information to low-privileged local users, con
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today