CVE-2021-21551: Dell dbutil_2_3.sys driver insufficient access control privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with public exploits and a very high EPSS score, though exploitation requires local authenticated access.

What it is

The Dell dbutil_2_3.sys driver contains insufficient access control that lets a local user reach privileged driver operations. It matters because the driver ships on many Dell client systems and the flaw enables elevation of privileges, denial of service, or information disclosure.

Impact

An attacker with local access gains the ability to escalate privileges, cause a denial of service, or read sensitive information on the affected host.

Attack surface

Reached locally through the driver's IOCTL interface; the CVSS vector (AV:L/PR:L/UI:N) indicates a local authenticated user is required and no user interaction is needed.

Exploitation

CISA added it to the KEV catalog on 2022-03-31 with a 2022-04-21 remediation due date, and public exploit references exist; EPSS 30-day probability is 0.79249 (99.58th percentile). No ransomware campaign use is documented.

What to do

• Apply the Dell client platform security update per DSA-2021-088 (patch first).
• Remove or replace the vulnerable dbutil_2_3.sys driver where it is not required.
• Restrict local administrative and interactive access on affected endpoints.
• Monitor for and block known exploit tooling targeting the driver's IOCTL interface.

Detection

• Hunt for dbutil_2_3.sys present on endpoints and flag unpatched versions.
• Monitor for unexpected loading of the dbutil driver or access to its device interface.
• Alert on suspicious local privilege escalation behavior following driver IOCTL activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.