EUVD-2026-84050
GHSA-7456-rj7f-rfjf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged access
-
ExploitRead Windows PowerShell event log
-
ExecutionExtract credentials logged by DCPP
-
ImpactReuse credentials for privilege escalation/lateral movement
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A09:2025 - Security Logging & Alerting Failures
ASVS 5.0
V16 - Security Logging and Error Handling Log data sanitization
|
| Exploitation Conditions | Requires local access to a Windows host running Dell Command PowerShell Provider prior to 2.10.2, and the low-privileged attacker must be able to read the Windows PowerShell event log where DCPP recorded sensitive credentials. Exploitation is gated by: (1) DCPP actually being installed and used to run cmdlets that pass credentials/passwords, so that secrets are written to the log; (2) local, authenticated presence on the machine (no remote/network path, PR:L); (3) the target credentials having been logged before the attacker reads them. No user interaction is needed. The limiting factors - local-only vector, requirement that privileged automation ran through DCPP, and niche deployment - substantially narrow real-world exposure versus the 7.8 headline. |
| Impact | The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) is internally inconsistent with the vulnerability class. This is CWE-532 (Insertion of Sensitive Information into Log File), and both the NVD description and the Dell advisory title ('credential theft via PowerShell event log') describe a read-only information-disclosure condition. A log-leak of credentials does not itself modify or destroy data, so the vendor's I:H and A:H ratings appear inflated; the realistic impact is C:H / I:N / A:N, which lowers the honest base score to roughly 5.5. There is no EPSS score, no CISA KEV listing, and no public POC in the provided intelligence, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision block was supplied. Net assessment: this is a genuine credential-exposure bug worth patching on Dell fleets that run DCPP automation, but it is a local, authenticated, disclosure-only issue - not a network-facing or automatable priority, and the headline 7.8 overstates real-world urgency because of the questionable Integrity/Availability metrics. |
| Exploit ScenarioDerived | On a Dell endpoint where administrators use DCPP cmdlets to configure BIOS/hardware settings (passing an admin or BIOS password), those secrets are recorded into the Windows PowerShell event log. A low-privileged local user (or malware running in a standard user context) reads the PowerShell operational/event log and harvests the plaintext credentials, then reuses them for privilege escalation or lateral movement. No public exploit code is identified; exploitation is trivial event-log reading and requires only local low-privileged access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Dell Command PowerShell Provider (DCPP) versions prior to 2.10.2 write sensitive information - specifically credentials passed to its cmdlets - into the Windows PowerShell event log, where they can be harvested by a low-privileged local user who can read that log. Exploitation requires an authenticated local presence on the Windows host (CVSS vector AV:L/PR:L) and depends on privileged automation having actually run through DCPP so that secrets were logged first; no user interaction is required. There is no public exploit code identified at time of analysis and the issue is not in CISA KEV, but the vendor assigns it a 7.8 severity while our independent assessment treats the impact as confidentiality-only (C:H/I:N/A:N), materially lowering real-world risk given the local-only vector, the dependency on prior DCPP use, and the niche deployment footprint.
RemediationAI
Vendor-released patch: upgrade Dell Command PowerShell Provider to version 2.10.2 or later, per Dell Security Advisory DSA-2026-379 (https://www.dell.com/support/kbdoc/en-us/000502472/dsa-2026-379-security-update-for-dell-command-powershell-provider-dcpp-for-a-credential-theft-via-powershell-event-log-vulnerability). Because patching does not erase secrets already written to disk, treat every credential that was ever passed to a DCPP cmdlet on an affected host as compromised: rotate those passwords and service accounts and, where feasible, remove or purge the historical Windows PowerShell and Microsoft-Windows-PowerShell/Operational event log entries - noting that purging destroys audit evidence and may itself trigger log-tampering alerts. Until upgrades complete, restrict read access to the event logs themselves (tighten ACLs on %SystemRoot%\System32\Winevt\Logs\Windows PowerShell.evtx and the Microsoft-Windows-PowerShell%4Operational.evtx channel so that only administrators can read them), accepting the trade-off that this also restricts legitimate monitoring and detection tooling. Avoid passing plaintext credentials as DCPP cmdlet parameters where an alternative such as an interactive or stored credential prompt can be used, and disable PowerShell script-block/parameter logging only if the resulting loss of audit coverage is an accepted risk for that host. Monitor for local log-read activity by non-administrative users as a detection signal, since that is the exploitation step for this flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-532 (Insertion of Sensitive Information into Log File), a failure to scrub secrets before they are persisted to a log sink. DCPP is Dell's PowerShell module for managing Dell client systems and BIOS configuration from Windows hosts; several of its cmdlets accept credential or password parameters. Because those invocations are recorded by PowerShell's own logging surfaces - the classic Windows PowerShell event log and the Microsoft-Windows-PowerShell/Operational log, which capture script blocks and command parameters - plaintext or recoverable secrets can end up at rest in the event log. The vendor advisory title frames this explicitly as 'credential theft via PowerShell event log', confirming the log, not memory or network traffic, is the exfiltration channel. The CPE cpe:2.3:a:dell:command_powershell_provider_(dcpp):*:*:*:*:*:*:*:* carries wildcards for version, indicating every release up to the fixed 2.10.2 is in scope. The vulnerability is a local information-disclosure primitive: confidentiality is fully compromised, but there is no evidence of code execution, data tampering, or denial of service, which is why our independent vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N rather than the vendor's 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-priv read of credentials from the PowerShell event log gives C:H, but a log-disclosure flaw neither modifies nor destroys data, so I:N/A:N and AV:L/AC:L/PR:L.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.
Executive ViewAI
Dell Command PowerShell Provider (DCPP) versions prior to 2.10.2 may expose privileged credentials by writing them to the Windows PowerShell event log on affected hosts. This creates a confidentiality risk in which an authenticated local user could harvest secrets from DCPP automation, potentially compromising downstream systems or privileged accounts. There is no public exploit identified at time of analysis, and the issue is not in CISA KEV; leadership should prioritize inventory, access restriction, and credential rotation while awaiting a vendor fix.
No vendor-released patch identified at time of analysis; restrict read access to Windows PowerShell event logs, limit local interactive logon and administrative rights, rotate credentials that may have been passed to DCPP, remove DCPP from non-essential hosts, and monitor for DCPP cmdlet execution and event log access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB