Read the docs
TI-2019-02767 Aliases CVE-2019-3750GHSA-p5h2-gjvx-mxw2

Uncontrolled search path in Dell Command Update

Priority LOW 25CWE-427Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.

Summary

Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability. A local authenticated malicious user with low privileges potentially could exploit this vulnerability to delete arbitrary files by creating a symlink from the "Temp\IC\ICDebugLog.txt" to any targeted file. This issue occurs because of insecure handling of Temp directory permissions that were set incorrectly.

Why it matters now

EPSS 0.00319 25th percentileScored 2026-11-07
Fix Fixed Dell Command Update (DCU) (Dell): 3.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellDell Command Update (DCU)before 3.13.1Patch availableCNA
  • Dell Command Update (DCU) VendorDell Affected before 3.1 Fixed in 3.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dell:command_update:*:*:*:*:*:*:*:*before 3.1VulnerableDell
  • cpe:2.3:a:dell:command_update:*:*:*:*:*:*:*:* Versions before 3.1 Vulnerable ·Dell

Remediation

  • Fix · CNA Dell Command Update (DCU) (Dell) Fixed in 3.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Dell Command Update (DCU) 3.1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2019-02766 Uncontrolled search path in Dell Command UpdatePriority LOW 25
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3750
  2. 2026-10-03 Alias added: GHSA-p5h2-gjvx-mxw2

References

Advisory 1

  • TI-2026-42154 Missing authorization in Dell Command Update CVSS 3.1HIGH 8.8
  • TI-2024-19153 Dell Command | Update, Dell Update, and Alienware Update UWP, versions prior to 5.4… CVSS 3.1HIGH 7.5
  • TI-2026-36723 Deserialization of untrusted data in Dell Command Update CVSS 3.1HIGH 7.8
  • TI-2026-36722 Deserialization of untrusted data in Dell Command Update CVSS 3.1HIGH 7.8
  • TI-2022-15283 Improper privilege management in Dell SupportAssist Client Consumer CVSS 3.1HIGH 7.8
  • TI-2026-42153 Incorrect default permissions in Dell Command Update CVSS 3.1HIGH 7.8
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences