EUVD-2026-93656
GHSA-rrmg-f4q7-ffqh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
ExploitLocate DCC plaintext credential storage
-
ExecutionRead stored password
-
ImpactReuse credentials for lateral movement
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V6 - Authentication Credential storage protection
|
| Exploitation Conditions | Exploitation requires the attacker to already possess low-privileged local access to a system with Dell Command | Configure (versions prior to 5.2.3.35) installed - a BIOS/system configuration utility typically present on Dell commercial-class endpoints. The limiting factors are significant: the flaw is not remotely reachable (AV:L), the attacker must have an authenticated local account (PR:L), and the payoff is limited to disclosure of a stored password (C:H, no integrity or availability impact). The description does not name the exact feature or file that stores the password in plaintext, so defenders cannot pin exploitation to a specific non-default configuration mode; it appears to stem from how DCC stores a password by default. |
| Impact | This is a moderate-severity, low-urgency issue. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a local, low-privileged, information-disclosure flaw with high confidentiality impact but no integrity or availability impact - consistent with CWE-256 (plaintext storage of a password). No EPSS score, SSVC decision, or POC indicator was provided in the input, and the vulnerability is NOT listed in CISA KEV, so there is no public evidence of exploitation. The signals are internally consistent (local attack vector matches a stored-credential disclosure scenario), so there is no CVSS-versus-description conflict to flag. Bottom line: this is a real but contained risk requiring a pre-existing local foothold; it is a patch-in-normal-cycle item rather than an emergency, and its value to an attacker is primarily credential harvesting for lateral movement after initial access is already achieved. Missing data to note: no EPSS, no SSVC, and no explicit POC status were supplied. |
| Exploit ScenarioDerived | An attacker who already has low-privileged local access to a Dell business system running Command | Configure reads a configuration or output file where DCC stores a password in plaintext, recovering credentials that may be reused elsewhere. No public exploit code was identified in the provided data, and exploitation requires prior local access rather than remote reachability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Plaintext storage of a password by Dell Command | Configure (DCC) in versions prior to 5.2.3.35 allows a low-privileged local user to read that credential and disclose it, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). This is a moderate-severity, low-urgency issue: the attacker must already hold an authenticated local account on a Dell commercial-class endpoint with DCC installed, and the impact is confined to information disclosure with no integrity or availability loss. There is no remote attack path, no public exploit identified at time of analysis, and no CISA KEV listing; the vendor has published a fixed build, 5.2.3.35, in Dell security advisory DSA-2026-378.
RemediationAI
Vendor-released patch: 5.2.3.35 - install Dell Command | Configure 5.2.3.35 or later per Dell security advisory DSA-2026-378 (https://www.dell.com/support/kbdoc/en-us/000502471/dsa-2026-378-security-update-for-dell-command-configure-for-multiple-vulnerabilities), which bundles fixes for multiple DCC issues. Because the patched code prevents future plaintext storage but does not retroactively remove secrets already written to disk, treat every credential previously supplied to DCC on an affected host as compromised and rotate it - in particular BIOS/System Setup administrator passwords and any DCC credential used for unattended configuration. Search affected endpoints for DCC working directories, generated packages, and scripts that contain cleartext credentials and delete or re-secure them; note the trade-off that removing saved credentials breaks unattended imaging and fleet-configuration automation, which will then require interactive entry or retrieval from an external secrets manager. Restrict local interactive and service-account access to hosts running DCC so that only administrators who genuinely need the configuration utility can read its files (removing local user access closes the PR:L prerequisite, at the cost of broader administrative access for routine BIOS configuration tasks). Until the upgrade is deployed everywhere, prioritize remediation on shared or multi-user Dell endpoints where an ordinary local account could read another user's stored credential, and de-prioritize single-user, fully trusted workstations given the local-only, low-privilege, confidentiality-only profile.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-256: Plaintext Storage of a Password. Dell Command | Configure is a Windows command-line utility that generates and applies BIOS/System Setup configuration on Dell commercial endpoints and is commonly scripted for imaging, fleet standardization and unattended deployment, where credentials (for example BIOS admin or configuration-application credentials) are supplied to DCC and retained locally. Because those secrets are persisted without encryption or hashing, any process running as the local user that can read the DCC configuration store, generated package, or associated file can recover the cleartext password. The CVSS vector confirms the mechanics: AV:L means the secret must be read from the local host rather than across the network, PR:L means an ordinary authenticated local account is sufficient, UI:N means no user interaction is required from the victim, and the C:H/I:N/A:N profile means the sole consequence is full confidentiality loss of the stored credential with no modification or denial-of-service effect. The affected CPE, cpe:2.3:a:dell:command_|_configure_(dcc):*:*:*:*:*:*:*:*, uses a wildcard version, so all builds before 5.2.3.35 should be treated as in scope. The advisory does not identify the specific DCC feature or file that holds the plaintext secret, so defenders cannot tie exploitation to an unusual, non-default configuration mode; the exposure appears to follow from how DCC stores a password by default.
Know when Command Configure Dcc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local-only flaw requiring an authenticated low-privileged user (AV:L, PR:L), exploitation is straightforward (AC:L), and impact is credential disclosure only (C:H, I:N, A:N).
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
1DescriptionCVE.org
Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB