CVE-2023-23697: medium-severity vulnerability in Dell Command Update (DCU)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Dell Command | Intel vPro Out of Band (before version 4.4.0) has a flaw that allows a logged-in user to delete any folder on the system during the uninstallation process. This could be exploited to damage or disable the system by removing important files.
The vulnerability exists in the uninstallation routine of Dell Command | Intel vPro Out of Band versions prior to 4.4.0, where insufficient path validation allows arbitrary folder deletion. An authenticated local attacker can exploit this by manipulating the uninstallation process to delete critical system or application directories, resulting in denial of service or system instability.
In the same product, most dangerous first.