Read the docs
TI-2019-02763 Aliases CVE-2019-3745GHSA-5hp5-8cvm-4m2x

Uncontrolled search path in Dell Encryption Enterprise

Priority LOW 32CWE-427Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.

Summary

The vulnerability is limited to the installers of Dell Encryption Enterprise versions prior to 10.4.0 and Dell Endpoint Security Suite Enterprise versions prior to 2.4.0. This issue is exploitable only during the installation of the product by an administrator. A local authenticated low privileged user potentially could exploit this vulnerability by staging a malicious DLL in the search path of the installer prior to its execution by a local administrator. This would cause loading of the malicious DLL, which would allow the attacker to execute arbitrary code in the context of an administrator.

Why it matters now

EPSS 0.00293 22nd percentileScored 2026-11-07
Fix Fixed Dell Encryption Enterprise (Dell): 10.4.0Dell Endpoint Security Suite Enterprise (Dell): 2.4.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellDell Encryption Enterprisebefore 10.4.010.4.0Patch availableCNA
DellDell Endpoint Security Suite Enterprisebefore 2.4.02.4.0Patch availableCNA
  • Dell Encryption Enterprise VendorDell Affected before 10.4.0 Fixed in 10.4.0 Patch available CNA
  • Dell Endpoint Security Suite Enterprise VendorDell Affected before 2.4.0 Fixed in 2.4.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:dell:encryption:*:*:*:*:enterprise:*:*:*before 10.4.0VulnerableDell
cpe:2.3:a:dell:endpoint_security_suite_enterprise:*:*:*:*:*:*:*:*before 2.4.0VulnerableDell
  • cpe:2.3:a:dell:encryption:*:*:*:*:enterprise:*:*:* Versions before 10.4.0 Vulnerable ·Dell
  • cpe:2.3:a:dell:endpoint_security_suite_enterprise:*:*:*:*:*:*:*:* Versions before 2.4.0 Vulnerable ·Dell

Remediation

  • Fix · CNA Dell Encryption Enterprise (Dell) Fixed in 10.4.0
  • Fix · CNA Dell Endpoint Security Suite Enterprise (Dell) Fixed in 2.4.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3745
  2. 2026-10-03 Alias added: GHSA-5hp5-8cvm-4m2x

References

Advisory 1

  • TI-2025-24915 Link following in Dell Encryption CVSS 3.1HIGH 7.8
  • TI-2025-24879 Link following in Dell Encryption Admin Utilities CVSS 3.1HIGH 7.8
  • TI-2023-15761 Improper access control in Dell Encryption CVSS 3.1HIGH 7.8
  • TI-2018-11245 Dell Encryption and Dell Endpoint Security Suite Enterprise Security Policy Overwrite Vulnerability CVSS 3.0HIGH 7.5
  • TI-2025-29338 Link following in Dell Encryption CVSS 3.1HIGH 7.3
  • TI-2020-04432 Incorrect permission assignment in Dell Encryption Enterprise CVSS 3.1HIGH 7.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences