EUVD-2026-62530
GHSA-pfg3-cwvg-6jfv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
TOCTOU race conditions require winning a timing window, justifying AC:H over the vendor-assigned AC:L; all other metrics align with description.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
3DescriptionCVE.org
Dell Command Update (DCU), versions prior to 5.7.1, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
AnalysisAI
Elevation of privileges in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a low-privileged local attacker through a Time-of-check Time-of-use (TOCTOU) race condition (CWE-367). The CVSS 3.1 score of 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation requires only a local low-privileged account with no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; Dell has released a remediated version (5.7.1) per advisory DSA-2026-309.
Technical ContextAI
Dell Command Update (DCU) is a Dell-proprietary driver, firmware, and software update utility deployed on Dell client hardware. CWE-367 (TOCTOU Race Condition) describes a class of flaw where a program validates the state of a resource (e.g., a file, directory, or handle) and then acts on it, but an adversary modifies the resource in the window between those two operations. In update utilities like DCU, this commonly manifests during staged file writes, installer extractions, or privilege-escalating subprocess invocations - where DCU checks a path or file attribute as a non-privileged resource and then opens or executes it with elevated rights. The affected CPE is cpe:2.3:a:dell:dell_command_update_(dcu):*:*:*:*:*:*:*:*, covering all DCU variants prior to 5.7.1. The CVSS scope is Unchanged (S:U), indicating the privilege escalation is confined to the local system rather than pivoting to another security domain.
RemediationAI
Upgrade Dell Command Update to version 5.7.1 or later, as confirmed by Dell advisory DSA-2026-309 (https://www.dell.com/support/kbdoc/en-us/000501378/dsa-2026-309-security-update-for-dell-command-update-for-multiple-vulnerabilities). If immediate upgrade is not feasible, restrict local interactive logon rights on affected systems to trusted administrative accounts only, reducing the pool of principals capable of staging a race condition attack. Disabling or uninstalling DCU entirely on systems that do not require automated Dell updates is a valid compensating control with the trade-off of losing automated driver and firmware currency. Application of filesystem monitoring (e.g., Windows auditing on DCU working directories) can provide detection coverage but does not prevent exploitation.
More in Dell Command Update Dcu
View allPrivilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to gain
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 enables a low-privileged local attacker to f
Elevation of privilege via deserialization of untrusted data affects Dell Command Update (DCU) versions prior to 5.7.1 o
Incorrect Default Permissions in Dell Command Update (DCU) exposes a local privilege escalation path on all versions pri
Missing Authorization in Dell Command Update (DCU) versions prior to 5.7.1 permits a low-privileged local user to invoke
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a local low-privileged atta
Local privilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a low-privileged local attacker t
XML External Entity injection in Dell Command Update (DCU) versions prior to 5.7.1 enables a local attacker with low-pri
Dell Command Update (DCU) versions prior to 5.7.1 expose sensitive system information to low-privileged local users, con
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to ga
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today