Vulnerability · Published Jan 18, 2023 · Assigned by dell

CVE-2022-34457

High 7.3

In plain English

A high-severity improper access control in Dell Command Configure (DCC) from Dell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.2%top 88.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Dell command configuration, version 4.8 and prior, contains improper folder permission when installed not to default path but to non-secured path which leads to privilege escalation. This is critical severity vulnerability as it allows non-admin to modify the files inside installed directory and able to make application unavailable for all users.

Affected products (as reported)

Vendor	Product	Versions
Dell	Dell Command Configure (DCC)	0 – through 4.8

Weakness: CWE-284 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

https://www.dell.com/support/kbdoc/000205633 vendor-advisory