EUVD-2026-93774
GHSA-6w5x-c2jr-5wmf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privileged access
-
ExploitPlant crafted path/file via traversal
-
ExecutionDSU privileged process resolves path
-
ImpactExecute code at elevated privilege
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that Dell System Update (DSU) at a version prior to 2.3.0.0 is installed, and that the attacker already has local, low-privileged authenticated access to that host (per AV:L and PR:L). The path traversal (CWE-22) lets the attacker supply a crafted pathname that escapes the intended restricted directory so the privileged DSU process acts on an attacker-controlled location, yielding code execution. Limiting factors that reduce real-world risk: no remote/network exploitation is possible, the attacker must already hold a local account or code-execution foothold, and systems updated to 2.3.0.0 or later are not affected. No user interaction by a separate victim is required. |
| Impact | This is a legitimately high-severity local privilege escalation / code execution flaw but NOT an urgent internet-facing emergency. The CVSS 3.1 score of 7.8 is driven by local vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), no user interaction, and total CIA impact (C:H/I:H/A:H) on an unchanged scope. Multiple independent signals converge on 'real but not widespread': EPSS is very low at 0.22% (11th percentile), CISA SSVC marks Exploitation as 'none' and Automatable as 'no' (consistent with a local-only, non-wormable bug), though it rates Technical Impact as 'total' which aligns with the full-impact CVSS. There is no CISA KEV listing and no public POC referenced. The signals are consistent with each other - a serious local code-execution vulnerability in a privileged updater, but requiring an attacker to already have a foothold on the host, hence low real-world exploitation probability. Priority should be driven by how broadly Dell System Update is deployed in the fleet rather than by fear of mass exploitation. No conflicting data was identified; the local vector in the CVSS matches the description's 'local access' language. |
| Exploit ScenarioDerived | A low-privileged local user (or malware running under a standard account) on a Dell business PC abuses the path traversal in Dell System Update to escape a restricted directory and have the privileged update process load or execute an attacker-controlled file, resulting in code execution at elevated privilege. No public exploit is identified at time of analysis, so this would require custom exploit development against the pre-2.3.0.0 updater. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 13, 2026
Local privilege escalation and code execution in Dell System Update (DSU) versions prior to 2.3.0.0 allows an authenticated, low-privileged local user to supply a crafted pathname that escapes the directory DSU intends to restrict, causing the elevated DSU process to read, write, or execute content from an attacker-controlled location. Exploitation yields complete loss of confidentiality, integrity, and availability on the affected host (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but it is not remotely reachable and requires the attacker to already hold a local low-privileged account or code-execution foothold; no public exploit code has been identified at time of analysis, EPSS is low at 0.22% (11th percentile), and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no'. Vendor-released patch: 2.3.0.0.
Earlier versions of this analysis (1)
Path traversal (CWE-22) in Dell System Update (DSU) versions prior to 2.3.0.0 lets a locally positioned attacker with low privileges escape the intended directory and write files to locations of their choosing, which Dell assesses as enabling code execution (CVSS 3.1 base 7.3, C:H/I:H/A:H). Exploitation is not remote in practice despite the vendor's 'remote execution' wording: the vector is AV:L/PR:L/UI:R, so the attacker must already hold a low-privilege local account and a legitimate user must actively trigger the DSU update workflow for the traversal to be exercised. There is no public exploit identified at time of analysis, and no CISA KEV listing; real-world risk is concentrated on hosts where DSU is installed and routinely run, and there is no indication the flaw is reachable against default configurations without the stated preconditions.
RemediationAI
Upgrade Dell System Update to 2.3.0.0 or later, the exact fixed version published in Dell advisory DSA-2026-324 (https://www.dell.com/support/kbdoc/en-us/000515843/dsa-2026-324-security-update-for-dell-system-update-dsu-vulnerabilities); this is the only complete fix because the defect is in DSU's own path handling. Where immediate upgrading is not possible, reduce the attack surface by removing DSU from hosts that do not require firmware or driver update capability, or by removing local interactive access for low-privileged accounts on systems that must retain it - the trade-off is that standard users lose the ability to run DSU themselves and updates must be staged by administrators. Additionally, restrict DSU execution to administrator-controlled directories on trusted storage and audit DSU invocations for path arguments that resolve outside the expected repository root; note that these are detective and preventive compensations that do not remove the underlying traversal, so patching remains mandatory. Because exploitation requires an existing local foothold, prioritize remediation on multi-user, shared, and jump hosts where low-privileged accounts are common rather than treating this as an internet-facing emergency.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic path traversal (CWE-22, Improper Limitation of a Pathname to a Restricted Directory) in Dell System Update (DSU), the command-line update utility Dell ships for applying BIOS, firmware, and driver updates to Dell client and server systems. DSU resolves file paths relative to a designated local repository or working directory; because the supplied pathname is not adequately canonicalized or constrained, sequences that resolve outside that restricted root are honored by the process. Since DSU operates with elevated privileges and consumes the referenced files, traversal converts a path-handling defect into arbitrary file access and, ultimately, execution of attacker-influenced content in a privileged context. The CPE cpe:2.3:a:dell:system_update:*:*:*:*:*:*:*:* confirms that all DSU builds below the fixed release are in scope, and the CVSS vector confirms the attack is local (AV:L), requires no user interaction beyond the attacker's own actions (UI:N), needs low privileges already held on the host (PR:L), and is scoped to the vulnerable component while still producing high confidentiality, integrity, and availability impact.
Know when System Update gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only updater flaw needs an authenticated low-privileged user (AV:L, PR:L) with no special timing (AC:L), and path traversal into a privileged process yields full code execution (C/I/A:H).
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Remote execution.
Executive ViewAI
Dell System Update (DSU) versions prior to 2.3.0.0 contain a local privilege escalation flaw that lets an attacker with an existing low-privileged account gain full control of the affected host, compromising all data and services on that system. Because exploitation requires a pre-existing local foothold, the primary risk is to endpoints and servers already accessed by an attacker or malicious insider, potentially enabling lateral movement and persistence within the environment. Leadership should prioritize patching to close this escalation path and reduce the impact of any existing compromises.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in System Update
View allLenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allo
Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the
A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ab
Path traversal in Dell System Update (DSU) versions prior to 2.3.0.0 allows an unauthenticated remote attacker to escape
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during
Privilege escalation in Dell System Update versions prior to 2.3.0.0 lets a low-privileged local attacker abuse an incor
Elevation of privilege in Dell System Update (DSU) versions prior to 2.3.0.0 allows an authenticated, low-privileged loc
An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local a
MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contai
A denial of service vulnerability was reported in Lenovo System Update versions prior to 5.07.0088 that could allow conf
A denial of service vulnerability was reported in Lenovo System Update before version 5.07.0084 that could allow service
Lenovo System Update contains an authentication bypass (CWE-290) that permits a locally authenticated standard user to c
Exploit-DB