Repository Manager
Monthly
Incorrect default permissions in Dell Repository Manager (DRM) versions prior to 3.5.2 let an attacker who already holds a low-privileged account on a Windows host abuse misconfigured files, directories, or service resources to escalate to a higher-privileged context. Dell rates this 8.5 (High) with a remote, scope-changing vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), but our independent assessment scores it 7.8 as a local privilege-escalation issue (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): exploitation requires an existing foothold on a machine where DRM is installed, is not a default unauthenticated remote scenario, and is limited to systems running DRM below 3.5.2. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fixed release (3.5.2) via Dell security advisory DSA-2026-419.
Dell Repository Manager versions before 3.4.8 suffer from an uncontrolled search path vulnerability that allows local attackers with low privileges to execute arbitrary code and escalate their access. An attacker with local system access and user interaction can exploit improper path handling to inject malicious code into the application's execution flow. A patch is available to remediate this HIGH severity issue affecting the repository management functionality.
Local privilege escalation in Dell Repository Manager 3.4.7 and 3.4.8 allows an authenticated low-privileged user with local access to gain elevated privileges. The flaw is tracked as CWE-280 and rated CVSS 7.8; no public exploit code or CISA KEV active exploitation is identified at time of analysis, and EPSS is 0.01%, so risk is primarily to systems where an attacker already has a low-privileged local foothold.
Dell Repository Manager, versions 3.4.2 through 3.4.4,contains a Path Traversal vulnerability in logger module. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Dell Repository Manager, versions prior to 3.4.5, contains a Path Traversal vulnerability in API module. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Incorrect default permissions in Dell Repository Manager (DRM) versions prior to 3.5.2 let an attacker who already holds a low-privileged account on a Windows host abuse misconfigured files, directories, or service resources to escalate to a higher-privileged context. Dell rates this 8.5 (High) with a remote, scope-changing vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), but our independent assessment scores it 7.8 as a local privilege-escalation issue (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): exploitation requires an existing foothold on a machine where DRM is installed, is not a default unauthenticated remote scenario, and is limited to systems running DRM below 3.5.2. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fixed release (3.5.2) via Dell security advisory DSA-2026-419.
Dell Repository Manager versions before 3.4.8 suffer from an uncontrolled search path vulnerability that allows local attackers with low privileges to execute arbitrary code and escalate their access. An attacker with local system access and user interaction can exploit improper path handling to inject malicious code into the application's execution flow. A patch is available to remediate this HIGH severity issue affecting the repository management functionality.
Local privilege escalation in Dell Repository Manager 3.4.7 and 3.4.8 allows an authenticated low-privileged user with local access to gain elevated privileges. The flaw is tracked as CWE-280 and rated CVSS 7.8; no public exploit code or CISA KEV active exploitation is identified at time of analysis, and EPSS is 0.01%, so risk is primarily to systems where an attacker already has a low-privileged local foothold.
Dell Repository Manager, versions 3.4.2 through 3.4.4,contains a Path Traversal vulnerability in logger module. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Dell Repository Manager, versions prior to 3.4.5, contains a Path Traversal vulnerability in API module. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.