EUVD-2026-62512
GHSA-4w8m-8vvx-gcw2
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Local-only vector and low-privilege requirement reflect a desktop utility authorization gap; UI:R constrains automation; full C/I/A consistent with DCU's system-level driver and firmware access.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
3DescriptionCVE.org
Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.
AnalysisAI
Missing Authorization in Dell Command Update (DCU) versions prior to 5.7.1 permits a low-privileged local user to invoke protected application functions without adequate authorization checks, yielding full confidentiality, integrity, and availability impact on the vulnerable system. Rooted in CWE-862, the flaw bypasses expected access controls within the DCU client utility - a driver and firmware management tool deployed across Dell client hardware fleets. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Technical ContextAI
Dell Command Update (DCU) is a Dell-developed software utility for Windows client systems that automates discovery, download, and installation of Dell driver, BIOS, and firmware updates. The affected scope per CPE is cpe:2.3:a:dell:dell_command_update_(dcu):*:*:*:*:*:*:*:*, covering all DCU versions prior to 5.7.1. CWE-862 (Missing Authorization) describes a class of flaws where the application executes a sensitive operation without verifying that the requestor holds the necessary permission - distinct from authentication failures, this is a post-authentication authorization gap where a legitimately logged-in low-privileged user reaches functionality reserved for higher-trust principals. Because DCU interacts with low-level system components including BIOS and driver stacks, unauthorized invocation of its protected operations can carry disproportionate impact relative to the attacker's initial privilege level.
RemediationAI
Upgrade Dell Command Update to version 5.7.1 or later, which resolves this vulnerability per Dell advisory DSA-2026-309 at https://www.dell.com/support/kbdoc/en-us/000501378/dsa-2026-309-security-update-for-dell-command-update-for-multiple-vulnerabilities. If immediate patching is operationally infeasible, restrict local interactive logon rights on systems running DCU to only those users who require it - removing low-privileged general users from DCU-enabled endpoints reduces the reachable attack population. Additionally, enforcing User Account Control (UAC) policies and monitoring DCU process invocations for anomalous behavior can serve as detective compensating controls, though neither substitutes for the vendor patch. No vendor-documented workaround that fully mitigates the missing authorization flaw is identified in available data.
More in Dell Command Update Dcu
View allPrivilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to gain
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 enables a low-privileged local attacker to f
Elevation of privilege via deserialization of untrusted data affects Dell Command Update (DCU) versions prior to 5.7.1 o
Incorrect Default Permissions in Dell Command Update (DCU) exposes a local privilege escalation path on all versions pri
Elevation of privileges in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a low-privileged local att
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a local low-privileged atta
Local privilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a low-privileged local attacker t
XML External Entity injection in Dell Command Update (DCU) versions prior to 5.7.1 enables a local attacker with low-pri
Dell Command Update (DCU) versions prior to 5.7.1 expose sensitive system information to low-privileged local users, con
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to ga
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today