CVE-2023-23698: medium-severity vulnerability in Dell Command Update (DCU)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The installer for Dell Command | Update and related tools has a flaw that allows a local attacker to delete arbitrary files on your system. This happens because the installer doesn't properly validate Windows shortcuts, giving someone with local access a way to cause damage.
An insecure junction handling vulnerability in the installer component of Dell Command | Update (versions < 4.6.0 and < 4.7.1) allows local attackers to perform arbitrary file deletion. The vulnerability exists in how the installer processes Windows junctions without proper validation, enabling privilege escalation through symlink/junction hijacking attacks during installation.
In the same product, most dangerous first.