EUVD-2026-93790
GHSA-92g4-24pp-5mvc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged local user
-
DeliveryWrite to insecurely-permissioned System Update resource
-
ExploitPrivileged user runs Dell System Update
-
ExecutionPlanted code executes with elevated privileges
-
ImpactFull host compromise (C/I/A:H)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Permission assignment review
|
| Exploitation Conditions | Requires (1) local access to a host with Dell System Update installed at a version prior to 2.3.0.0, (2) a valid low-privileged local account (PR:L), and (3) user interaction (UI:R) - most plausibly a higher-privileged user executing Dell System Update after the attacker has staged malicious content in a resource left writable by the incorrect permission assignment (CWE-732). Limiting factors that reduce real-world risk: no remote/network exploitation is possible (AV:L), the attacker must already have a foothold with valid credentials, the targeted updater must be installed, and successful escalation depends on a privileged user actually running the tool. Default configuration exposure beyond 'DSU installed' is not detailed in the advisory. |
| Impact | This is a locally-exploitable privilege-escalation flaw (CWE-732, Incorrect Permission Assignment) rated CVSS 8.2 by Dell. The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H shows the high score is driven by the Scope:Changed flag plus full C/I/A:H impact, NOT by remote reach - attack vector is Local (AV:L) and it requires an existing low-privileged account (PR:L) and user interaction (UI:R). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Realistically this is a solid-but-not-emergency patch priority: the 8.2 looks alarming, but AV:L + PR:L + UI:R materially constrain exploitation to an attacker who already has a foothold and can induce a privileged user to run the affected software. Treat it as important for multi-user Dell endpoints/servers where local accounts are untrusted, rather than as an internet-facing crisis. Note a data gap: the SSVC decision framework, EPSS, and POC status are all absent from the input and cannot be assessed. |
| Exploit ScenarioDerived | A low-privileged local user on a system running Dell System Update prior to 2.3.0.0 abuses the insecure permissions on a critical resource (e.g., a writable file or directory the updater trusts) to plant malicious content. When a higher-privileged user subsequently launches System Update (satisfying UI:R), the planted content executes in the elevated context, giving the attacker full control. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Privilege escalation in Dell System Update versions prior to 2.3.0.0 lets a low-privileged local attacker abuse an incorrectly secured critical resource to gain higher privileges (CVSS 8.2, CWE-732). Exploitation requires local access, a valid low-privileged account, and user interaction-most plausibly an administrator running the updater after malicious content has been staged in a writable location-so remote or unauthenticated attack is not possible. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
RemediationAI
Vendor-released patch: Dell System Update 2.3.0.0. Upgrade DSU to 2.3.0.0 or later as directed by Dell's DSA-2026-324 advisory (https://www.dell.com/support/kbdoc/en-us/000515843/dsa-2026-324-security-update-for-dell-system-update-dsu-vulnerabilities). Until upgrading, apply compensating controls that remove the writable-by-low-privilege-user condition on DSU installation, log, and configuration paths: audit those paths and tighten file-system ACLs (NTFS or POSIX) so that only administrators and the DSU service identity can write to them-the trade-off being that overly strict ACLs may break automated update, logging, or inventory workflows that rely on non-administrator write access. Also restrict interactive logon on patch-management hosts to trusted administrators and avoid invoking DSU with elevated rights from directories that ordinary users can modify, which reduces the required user-interaction (UI:R) trigger surface but does not remediate the underlying permission defect. Monitor for unexpected file creation or modification inside DSU directories as a detection measure. No public exploit code was identified at time of analysis, so exploitation is not expected to be trivial, but the high CVSS impact warrants prompt patching; if DSU is not required on a host, uninstalling it removes the attack surface entirely.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-732 (Incorrect Permission Assignment for Critical Resource) is the root cause: Dell System Update (DSU) installs or maintains at least one file, directory, or resource with permissions that a low-privileged local user can write to, while the updater later touches that resource with higher privileges. The assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H describes a local attack (AV:L) by an authenticated low-privileged user (PR:L) that requires victim interaction (UI:R), results in a scope change (S:C), and yields high confidentiality, integrity, and availability impact. In practice, an attacker with a foothold stages malicious content in the weakly permissioned resource and waits for an administrator or service context to run DSU; because the updater operates with elevated rights, the injected content is processed in a privileged context and elevation of privileges follows. The CPE cpe:2.3:a:dell:system_update:*:*:*:*:*:*:*:* identifies Dell System Update as the affected product, and the wildcard version reflects the advisory's statement that all releases prior to 2.3.0.0 are impacted.
Know when System Update gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Local privesc needing an existing low-priv account (PR:L) and a privileged user to run the tool (UI:R); scope changes as a low-priv user gains admin context, yielding full C/I/A:H.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
Executive ViewAI
A privilege-escalation flaw in Dell System Update (versions before 2.3.0.0) allows a low-privileged user on an already-compromised or shared endpoint to elevate to higher privileges by abusing an insecurely configured resource, and Dell has not yet released a fix. Because exploitation demands local access, a valid low-privileged account, and an administrator running the updater after malicious content is staged, the risk is concentrated in managed endpoint fleets and administrative workstations rather than internet-facing systems. Leadership should care because the tooling used to keep Dell hardware patched is itself currently unpatched, creating a path for attackers who already have a foothold to gain administrative control of the machine.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce least privilege so standard users cannot write to Dell System Update binaries, configuration, or staging directories; restrict interactive logon on hosts running the updater to trusted administrators; require administrative review and validation before executing updates; monitor for unexpected privilege changes and anomalous updater activity; and limit the blast radius by isolating or decommissioning unmanaged hosts where the updater cannot be secured.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in System Update
View allLenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allo
Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the
A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ab
Path traversal in Dell System Update (DSU) versions prior to 2.3.0.0 allows an unauthenticated remote attacker to escape
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during
Elevation of privilege in Dell System Update (DSU) versions prior to 2.3.0.0 allows an authenticated, low-privileged loc
Local privilege escalation and code execution in Dell System Update (DSU) versions prior to 2.3.0.0 allows an authentica
An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local a
MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contai
A denial of service vulnerability was reported in Lenovo System Update versions prior to 5.07.0088 that could allow conf
A denial of service vulnerability was reported in Lenovo System Update before version 5.07.0084 that could allow service
Lenovo System Update contains an authentication bypass (CWE-290) that permits a locally authenticated standard user to c
Exploit-DB