CVE-2023-39253

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. A local authenticated non-administrator user could potentially exploit this vulnerability, leading to the elevation of privilege on the system.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Dell	Dell OS Recovery Tool	Versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0.

References

Timeline

Published: Nov 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-392547.3Dell Update Package (DUP), Versions prior to 4.9.10 contain an Uncontrolled Search Path vulnerability. A malicious user with local access to CVE-2023-392567.8Dell Rugged Control Center, version prior to 4.7, contains an improper access control vulnerability. A local malicious standard user could p CVE-2023-392577.8Dell Rugged Control Center, version prior to 4.7, contains an Improper Access Control vulnerability. A local malicious standard user could p CVE-2023-392597.8Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. A local authenticated CVE-2023-392617.8In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions CVE-2023-392644.3By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vul CVE-2023-392656.5Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like CVE-2023-392666.1A vulnerability in the ArubaOS-Switch web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site CVE-2023-392676.5An authenticated remote code execution vulnerability exists in the command line interface in ArubaOS-Switch. Successful exploitation results CVE-2023-392689.8A memory corruption vulnerability in ArubaOS-Switch could lead to unauthenticated remote code execution by receiving specially crafted packe CVE-2023-392697.5A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC,CVE-2023-392707.8Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2