Command Configure Dcc
Monthly
Privilege elevation on Dell client endpoints that have Dell Command | Configure (DCC) installed at a version below 5.2.3.35, driven by improper handling of mixed encoding (CWE-175) that allows crafted, ambiguously encoded input to be processed in a way that yields elevated rights. Dell labels the flaw 9.8 with an AV:N/AC:L/PR:N/UI:N vector, but our independent assessment treats it as a local, low-privilege-triggered defect (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) because DCC is an optional local client-configuration utility rather than a network service and the advisory never identifies a remotely reachable interface - the input signals are sharply conflicting and must not be reconciled uncritically. There is no public exploit identified at time of analysis, EPSS is low at 0.27% (18th percentile), CISA SSVC records exploitation as none, and a vendor patch is available.
Plaintext storage of a password by Dell Command | Configure (DCC) in versions prior to 5.2.3.35 allows a low-privileged local user to read that credential and disclose it, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). This is a moderate-severity, low-urgency issue: the attacker must already hold an authenticated local account on a Dell commercial-class endpoint with DCC installed, and the impact is confined to information disclosure with no integrity or availability loss. There is no remote attack path, no public exploit identified at time of analysis, and no CISA KEV listing; the vendor has published a fixed build, 5.2.3.35, in Dell security advisory DSA-2026-378.
Privilege elevation on Dell client endpoints that have Dell Command | Configure (DCC) installed at a version below 5.2.3.35, driven by improper handling of mixed encoding (CWE-175) that allows crafted, ambiguously encoded input to be processed in a way that yields elevated rights. Dell labels the flaw 9.8 with an AV:N/AC:L/PR:N/UI:N vector, but our independent assessment treats it as a local, low-privilege-triggered defect (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) because DCC is an optional local client-configuration utility rather than a network service and the advisory never identifies a remotely reachable interface - the input signals are sharply conflicting and must not be reconciled uncritically. There is no public exploit identified at time of analysis, EPSS is low at 0.27% (18th percentile), CISA SSVC records exploitation as none, and a vendor patch is available.
Plaintext storage of a password by Dell Command | Configure (DCC) in versions prior to 5.2.3.35 allows a low-privileged local user to read that credential and disclose it, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). This is a moderate-severity, low-urgency issue: the attacker must already hold an authenticated local account on a Dell commercial-class endpoint with DCC installed, and the impact is confined to information disclosure with no integrity or availability loss. There is no remote attack path, no public exploit identified at time of analysis, and no CISA KEV listing; the vendor has published a fixed build, 5.2.3.35, in Dell security advisory DSA-2026-378.