CVE-2023-39254

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

Dell Update Package (DUP), Versions prior to 4.9.10 contain an Uncontrolled Search Path vulnerability. A malicious user with local access to the system could potentially exploit this vulnerability to run arbitrary code as admin.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
Dell	DUP Framework	>= N/A, < 4.9.10
dell	update_package_framework	< 4.9.10

References

Timeline

Published: Mar 1, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-392567.8Dell Rugged Control Center, version prior to 4.7, contains an improper access control vulnerability. A local malicious standard user could p CVE-2023-392577.8Dell Rugged Control Center, version prior to 4.7, contains an Improper Access Control vulnerability. A local malicious standard user could p CVE-2023-392597.8Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. A local authenticated CVE-2023-392617.8In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions CVE-2023-392644.3By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vul CVE-2023-392656.5Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like CVE-2023-392666.1A vulnerability in the ArubaOS-Switch web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site CVE-2023-392676.5An authenticated remote code execution vulnerability exists in the command line interface in ArubaOS-Switch. Successful exploitation results CVE-2023-392689.8A memory corruption vulnerability in ArubaOS-Switch could lead to unauthenticated remote code execution by receiving specially crafted packe CVE-2023-392697.5A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC,CVE-2023-392707.8Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 CVE-2023-392717.8Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2