EUVD-2026-80874
GHSA-gp22-336p-2v4v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged access to DRM host
-
DeliveryLocate world-writable DRM file or service resource
-
ExploitPlant or modify privileged component
-
ExecutionTrigger execution at elevated context
-
ImpactGain elevated privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Default permission hardening
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold low-privileged access (PR:L) on a host where Dell Repository Manager prior to 3.5.2 is installed, and to abuse the product's incorrect default permissions on its files, directories, or service resources to influence a higher-privileged execution context. Limiting factors: AC:H indicates additional non-default timing or configuration conditions must be met, the attacker must have an existing foothold/account, and only systems with DRM below 3.5.2 are affected - not a default-out-of-the-box remote-unauthenticated scenario despite the AV:N rating. |
| Impact | The vendor CVSS 3.1 score of 8.5 (High) is driven by an aggressive metric combination - AV:N with scope change (S:C) and full C:H/I:H/A:H impact - but several signals argue this is a lower real-world priority than the number suggests. There is no CISA KEV listing, no public POC, and no EPSS value provided, so exploitation status is 'no public exploit identified at time of analysis.' More importantly, CWE-276 (Incorrect Default Permissions) is intrinsically a local file/ACL weakness, yet the vendor rates it AV:N; the description's phrase 'remote access' is vague and the AC:H already signals non-trivial preconditions. The AV:N + S:C + triple-High-impact combination is what inflates this to 8.5 and looks generous for a default-permissions EoP where an attacker is already a low-privileged local/authenticated user (PR:L). Net: treat as a moderate-priority patch (privilege escalation on an admin tooling host), not an emergency - the network-vector and scope-change claims should be verified against Dell DSA-2026-419 before assuming remote reachability. |
| Exploit ScenarioDerived | A low-privileged user on a system where Dell Repository Manager is installed leverages overly permissive default file/directory or service permissions to modify a component that executes at higher privilege, escalating to the privileges of the DRM service or administrator. No public exploit code is available, and the AC:H rating indicates the attacker must satisfy specific timing or configuration conditions rather than exploiting trivially. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Incorrect default permissions in Dell Repository Manager (DRM) versions prior to 3.5.2 let an attacker who already holds a low-privileged account on a Windows host abuse misconfigured files, directories, or service resources to escalate to a higher-privileged context. Dell rates this 8.5 (High) with a remote, scope-changing vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), but our independent assessment scores it 7.8 as a local privilege-escalation issue (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): exploitation requires an existing foothold on a machine where DRM is installed, is not a default unauthenticated remote scenario, and is limited to systems running DRM below 3.5.2. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fixed release (3.5.2) via Dell security advisory DSA-2026-419.
RemediationAI
Vendor-released patch: upgrade Dell Repository Manager to version 3.5.2, which is the fixed release named in Dell's advisory DSA-2026-419 (https://www.dell.com/support/kbdoc/en-us/000509459/dsa-2026-419-security-update-for-dell-repository-manager-drm-vulnerability); this is the only fully effective fix because the flaw is baked into the product's shipped default permissions. Where 3.5.2 cannot be deployed immediately, apply compensating controls that address the local privileged-abuse path: audit and tighten the NTFS ACLs on the DRM installation directory, its working/config folders, and any service or scheduled-task binaries so that standard users have no write or modify rights (side effect: some DRM operations may require re-granting rights to the service account, so test before rollout); run the DRM service and any related tasks under a dedicated least-privilege account rather than LocalSystem or an administrative user (trade-off: some catalog/repository synchronization functions may need elevated rights and could fail); and restrict interactive logon and local account provisioning on hosts running DRM so that attacker footholds are harder to obtain. Monitor for unexpected modifications to DRM binaries, plug-ins, and configuration files as a detection backstop, and note that no public exploit code was identified at time of analysis, so patching on a priority consistent with a local, authenticated escalation vector - not an emergency remote-RCE timeline - is reasonable.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-276 (Incorrect Default Permissions): DRM - Dell's Windows tool for building and managing OS deployment repository bundles and update catalogs - ships files, folders, or service resources with overly permissive ACLs, so a low-privileged local user can write to or replace content that is later consumed by a higher-privileged process or service. Effectively this is a permissions-based privilege-escalation primitive rather than a remote code-execution flaw in a network-facing protocol. The CPE entry cpe:2.3:a:dell:repository_manager:*:*:*:*:*:*:*:* is a wildcard that enumerates every DRM release as potentially affected, with the version threshold set by the advisory at 3.5.2. The divergence between the vendor vector and our assessment is meaningful: Dell applies AV:N, AC:H, and S:C - treating the flaw as remotely triggerable, requiring non-default timing/configuration conditions, and crossing a security scope boundary - whereas the assessed vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects the practical reality of a local attacker with existing credentials tampering with weakly protected artifacts that a privileged component then executes. Both vectors agree on PR:L, so authentication (a pre-existing low-privileged account) is required; neither describes an unauthenticated attack path. Impact in both readings is total for confidentiality, integrity, and availability of the affected host's privileged context.
Know when Repository Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Incorrect default permissions is a local weakness requiring an existing low-priv account (AV:L/PR:L), so it is local EoP without a genuine scope change; full impact on the escalated host justifies C/I/A:H.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
Executive ViewAI
Dell Repository Manager (DRM) versions before 3.5.2 pose a high risk of privilege escalation, allowing an attacker with a basic user account to take control of affected Windows systems. This could lead to unauthorized access to sensitive data and disruption of critical operations on those systems. No public exploit identified at time of analysis, but immediate patching to version 3.5.2 is recommended to prevent potential insider or lateral-movement attacks.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Repository Manager
View allLocal privilege escalation in Dell Repository Manager 3.4.7 and 3.4.8 allows an authenticated low-privileged user with l
Dell Repository Manager, versions prior to 3.4.5, contains a Path Traversal vulnerability in API module. Rated high seve
Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module.
Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module.
Dell Repository Manager versions before 3.4.8 suffer from an uncontrolled search path vulnerability that allows local at
Dell Repository Manager, versions 3.4.2 through 3.4.4,contains a Path Traversal vulnerability in logger module. Rated me
Exploit-DB