Insecure Operation Vulnerability in Dell Update and Alienware Update
CVE-2023-28071

6.3MEDIUM

Key Information:

Vendor

Dell
Status
Dell Command Update (dcu)
Vendor
CVE Published:
23 June 2023

What is CVE-2023-28071?

Dell Command | Update, Dell Update, and Alienware Update versions 4.9.0, A01 and prior are subject to a vulnerability that allows local attackers to perform insecure operations on Windows junctions or mount points. This flaw could enable malicious users to create arbitrary folders, potentially leading to a permanent Denial of Service condition, thereby disrupting system functions and restricting user access.

Affected Version(s)

Dell Command Update (DCU) Dell Command | Update 4.9.0, A01 and Prior

References

https://www.dell.com/support/kbdoc/en-us/000213546/dsa-20...
vendor-advisory

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.