Command Powershell Provider Dcpp
Monthly
Dell Command PowerShell Provider (DCPP) versions prior to 2.10.2 write sensitive information - specifically credentials passed to its cmdlets - into the Windows PowerShell event log, where they can be harvested by a low-privileged local user who can read that log. Exploitation requires an authenticated local presence on the Windows host (CVSS vector AV:L/PR:L) and depends on privileged automation having actually run through DCPP so that secrets were logged first; no user interaction is required. There is no public exploit code identified at time of analysis and the issue is not in CISA KEV, but the vendor assigns it a 7.8 severity while our independent assessment treats the impact as confidentiality-only (C:H/I:N/A:N), materially lowering real-world risk given the local-only vector, the dependency on prior DCPP use, and the niche deployment footprint.
Dell Command PowerShell Provider (DCPP) versions prior to 2.10.2 write sensitive information - specifically credentials passed to its cmdlets - into the Windows PowerShell event log, where they can be harvested by a low-privileged local user who can read that log. Exploitation requires an authenticated local presence on the Windows host (CVSS vector AV:L/PR:L) and depends on privileged automation having actually run through DCPP so that secrets were logged first; no user interaction is required. There is no public exploit code identified at time of analysis and the issue is not in CISA KEV, but the vendor assigns it a 7.8 severity while our independent assessment treats the impact as confidentiality-only (C:H/I:N/A:N), materially lowering real-world risk given the local-only vector, the dependency on prior DCPP use, and the niche deployment footprint.