← Vulnerability feed

Vulnerability record · CVE-2023-39254 · published 1 March 2024

CVE-2023-39254: Dell update package framework uncontrolled search path element vulnerability

Dell · Update Package Framework

Dell Update Package (DUP), Versions prior to 4.9.10 contain an Uncontrolled Search Path vulnerability. A malicious user with local access to the system could potentially exploit this vulnerability to run arbitrary code as admin.

7.3 CVSS 3.1 High EPSS 0.17% · top 94.2% CWE-427 · Uncontrolled search path element
7.3CVSS 3.1 base score
0.17%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Dell Update Package (DUP), Versions prior to 4.9.10 contain an Uncontrolled Search Path vulnerability. A malicious user with local access to the system could potentially exploit this vulnerability to run arbitrary code as admin.

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.dell.com/support/kbdoc/en-us/000217701/dsa-2023-338-security-update-for-a-dell-update-package-dup-framework- Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000217701/dsa-2023-338-security-update-for-a-dell-update-package-dup-framework- Vendor Advisory

Track CVE-2023-39254 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-86358Dell update package framework stack-based buffer overflow vulnerabilityDell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with adj…EPSS 0.41%8.2CVE-2026-23857Dell update package framework vulnerabilityDell Update Package (DUP) Framework, versions 23.12.00 through 24.12.00, contains an Improper Handling of Insufficient Permissions or Privileges vuln…EPSS 0.10%7.8CVE-2026-71180Dell update package framework unchecked return value vulnerabilityDell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low privileged attacker with local acc…EPSS 0.15%7.8CVE-2026-71179Dell update package framework os command injection vulnerabilityDell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command…EPSS 0.59%7.8CVE-2025-22395Dell update package framework vulnerabilityDell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability. A local low privileged attacker cou…EPSS 0.19%7.1CVE-2023-32454Dell update package framework link following vulnerabilityDUP framework version 4.9.4.36 and prior contains insecure operation on Windows junction/Mount point vulnerability. A local malicious standard user c…EPSS 0.17%6.7CVE-2019-3726Dell update package framework uncontrolled search path element vulnerabilityAn Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file versions prior to 19.1.0.413, and …EPSS 0.46%6.0CVE-2026-71181Dell update package framework link following vulnerabilityDell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. …EPSS 0.15%

Source: NIST National Vulnerability Database (record CVE-2023-39254), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.