EUVD-2026-62526
GHSA-wp5v-r46f-crq6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Local attack requiring low privileges; scope change and high confidentiality confirmed; I:L added to reflect EoP impact omitted from vendor vector.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell Command Update (DCU), versions prior to 5.7.1, contain an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges and Server-side request forgery.
AnalysisAI
XML External Entity injection in Dell Command Update (DCU) versions prior to 5.7.1 enables a local attacker with low-privilege access to perform server-side request forgery and escalate privileges. The vulnerability stems from insufficient restriction of XML external entity references during DCU's XML parsing operations. No public exploit code or CISA KEV listing exists at time of analysis, but the scope-changed CVSS vector (S:C) and high confidentiality impact confirm that exploitation crosses component boundaries, potentially exposing sensitive resources beyond DCU itself.
Technical ContextAI
Dell Command Update (DCU) is Dell's proprietary utility for managing driver, firmware, and BIOS updates on Dell commercial and enterprise systems. CWE-611 (Improper Restriction of XML External Entity Reference) describes a class of vulnerabilities where XML parsers are not configured to reject or ignore external entity declarations in XML input. An attacker controlling local XML content fed to DCU can inject XXE payloads that cause the parser to fetch external URIs (SSRF) or read local filesystem resources. The CVSS scope change (S:C) indicates the impact escapes the DCU process context itself, consistent with both SSRF reaching networked resources and privilege escalation affecting the underlying OS. The affected CPE is cpe:2.3:a:dell:dell_command_update_(dcu):*:*:*:*:*:*:*:* covering all versions before 5.7.1.
RemediationAI
Upgrade Dell Command Update to version 5.7.1 or later, as specified in Dell Security Advisory DSA-2026-309 available at https://www.dell.com/support/kbdoc/en-us/000501378/dsa-2026-309-security-update-for-dell-command-update-for-multiple-vulnerabilities. Until patching is possible, restrict local user access to DCU invocation points and any XML configuration files or input paths it processes, since exploitation requires low-privilege local access. Monitoring DCU processes for anomalous outbound network connections can help detect SSRF attempts; however, blocking outbound requests wholesale may interfere with DCU's legitimate update-checking functionality. No vendor-confirmed workaround is available beyond applying the patch.
More in Dell Command Update Dcu
View allPrivilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to gain
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 enables a low-privileged local attacker to f
Elevation of privilege via deserialization of untrusted data affects Dell Command Update (DCU) versions prior to 5.7.1 o
Incorrect Default Permissions in Dell Command Update (DCU) exposes a local privilege escalation path on all versions pri
Elevation of privileges in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a low-privileged local att
Missing Authorization in Dell Command Update (DCU) versions prior to 5.7.1 permits a low-privileged local user to invoke
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a local low-privileged atta
Local privilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a low-privileged local attacker t
Dell Command Update (DCU) versions prior to 5.7.1 expose sensitive system information to low-privileged local users, con
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to ga
Share
External POC / Exploit Code
Leaving vuln.today