EUVD-2026-62529
GHSA-p6h6-rfh8-ch8f
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only access with low privileges suffices to exploit permissive filesystem ACLs; full C/I/A reflects unrestricted file read and write capability with no scope change.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
3DescriptionCVE.org
Dell Command Update (DCU), versions prior to 5.7.1, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
AnalysisAI
Incorrect Default Permissions in Dell Command Update (DCU) exposes a local privilege escalation path on all versions prior to 5.7.1, allowing a low-privileged authenticated user to gain unauthorized read and write access to filesystem resources owned or managed by DCU. The flaw stems from overly permissive ACLs set during installation, consistent with CWE-276, and carries a CVSS 7.8 High rating reflecting full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Technical ContextAI
Dell Command Update is a Windows-based endpoint management utility that automates driver, firmware, and BIOS updates on Dell hardware. CWE-276 (Incorrect Default Permissions) identifies the root cause: during installation or runtime, DCU creates directories or executable paths with access control entries that grant write or modify rights to non-administrative users, contrary to least-privilege principles. The CVSS vector AV:L/AC:L/PR:L/UI:N confirms that exploitation is entirely local, requires only standard user-level access, and involves no race conditions or environmental complexity. The CPE identifier cpe:2.3:a:dell:dell_command_update_(dcu) scopes this strictly to the DCU application layer - not the Dell BIOS update engine or OS components - across all platform variants covered by the wildcard version field.
RemediationAI
The primary fix is to upgrade Dell Command Update to version 5.7.1 or later, as directed by Dell advisory DSA-2026-309 at https://www.dell.com/support/kbdoc/en-us/000501378/dsa-2026-309-security-update-for-dell-command-update-for-multiple-vulnerabilities. If immediate patching is not feasible, apply restrictive NTFS ACLs to DCU installation directories so that only SYSTEM and local Administrators hold write and modify rights, removing any inherited permissions that grant standard users write access; be aware this workaround may break DCU's self-update or scheduled scan functionality and should be tested in a non-production environment before broad rollout. On systems where automated driver updates are not operationally required, temporarily uninstalling DCU eliminates the attack surface entirely until the patch can be scheduled.
More in Dell Command Update Dcu
View allPrivilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to gain
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 enables a low-privileged local attacker to f
Elevation of privilege via deserialization of untrusted data affects Dell Command Update (DCU) versions prior to 5.7.1 o
Elevation of privileges in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a low-privileged local att
Missing Authorization in Dell Command Update (DCU) versions prior to 5.7.1 permits a low-privileged local user to invoke
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a local low-privileged atta
Local privilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a low-privileged local attacker t
XML External Entity injection in Dell Command Update (DCU) versions prior to 5.7.1 enables a local attacker with low-pri
Dell Command Update (DCU) versions prior to 5.7.1 expose sensitive system information to low-privileged local users, con
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to ga
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today