CVE-2023-28065
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.7epss 0.2%
exploitation probability
0.2%top 91% of all CVEs
observed exploitation
nono source reports it
In short
Dell Command | Update and similar tools before version 4.8.1 create temporary files in an unsafe way that attackers with local access can manipulate to gain higher system privileges. This matters because it allows someone with a regular user account to run malicious code with administrator powers.
Technical detail
The vulnerability exists in insecure handling of Windows junction points and mount points during temporary file operations. A local attacker can leverage this to perform a privilege escalation attack by manipulating the junction/mount point before the application accesses it, potentially achieving system-level code execution.
Summary generated and translated by AI from the official description.
Dell Command | Update, Dell Update, and Alienware Update versions 4.8.0 and prior contain an Insecure Operation on Windows Junction / Mount Point vulnerability. A local malicious user could potentially exploit this vulnerability leading to privilege escalation.
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected products
Dell · Dell Command Update (DCU)