Improper access control in Dell Encryption
Priority LOW 35CWE-284Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.
Summary
Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server versions prior to 11.9.0 contain privilege escalation vulnerability due to improper ACL of the non-default installation directory. A local malicious user could potentially exploit this vulnerability by replacing binaries in installed directory and taking reverse shell of the system leading to Privilege Escalation.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00087 0th percentileScored 2026-11-07
Fix Fixed Dell Encryption (Dell): 11.9.0Dell Endpoint Security Suite Enterprise (Dell): 11.9.0+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | Dell Encryption | before 11.9.0 | 11.9.0 | Patch available | CNA |
| Dell | Dell Endpoint Security Suite Enterprise | before 11.9.0 | 11.9.0 | Patch available | CNA |
| Dell | Dell Security Management Server (Windows) | before 11.9.0 | 11.9.0 | Patch available | CNA |
- Dell Encryption VendorDell Affected before 11.9.0 Fixed in 11.9.0 Patch available CNA
- Dell Endpoint Security Suite Enterprise VendorDell Affected before 11.9.0 Fixed in 11.9.0 Patch available CNA
- Dell Security Management Server (Windows) VendorDell Affected before 11.9.0 Fixed in 11.9.0 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dell:encryption:*:*:*:*:*:*:*:* | before 11.9.0 | Vulnerable | Dell |
| cpe:2.3:a:dell:endpoint_security_suite_enterprise:*:*:*:*:*:*:*:* | before 11.9.0 | Vulnerable | Dell |
| cpe:2.3:a:dell:security_management_server:*:*:*:*:*:*:*:* | before 11.9.0 | Vulnerable | Dell |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:dell:encryption:*:*:*:*:*:*:*:* Versions before 11.9.0 Vulnerable ·Dell
- cpe:2.3:a:dell:endpoint_security_suite_enterprise:*:*:*:*:*:*:*:* Versions before 11.9.0 Vulnerable ·Dell
- cpe:2.3:a:dell:security_management_server:*:*:*:*:*:*:*:* Versions before 11.9.0 Vulnerable ·Dell
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA Dell Encryption (Dell) Fixed in 11.9.0
- Fix · CNA Dell Endpoint Security Suite Enterprise (Dell) Fixed in 11.9.0
- Fix · CNA Dell Security Management Server (Windows) (Dell) Fixed in 11.9.0
Timeline
- 2026-10-02 Threatist record created from CVE-2023-32479
- 2026-10-03 Alias added: GHSA-whvw-59jf-hrx9
References
More Dell Encryption vulnerabilities
- TI-2025-24915 Link following in Dell Encryption CVSS 3.1HIGH 7.8
- TI-2025-24879 Link following in Dell Encryption Admin Utilities CVSS 3.1HIGH 7.8
- TI-2018-11245 Dell Encryption and Dell Endpoint Security Suite Enterprise Security Policy Overwrite Vulnerability CVSS 3.0HIGH 7.5
- TI-2025-29338 Link following in Dell Encryption CVSS 3.1HIGH 7.3
- TI-2020-04432 Incorrect permission assignment in Dell Encryption Enterprise CVSS 3.1HIGH 7.8
- TI-2020-04409 Incorrect permission assignment in Dell Encryption Enterprise CVSS 3.1HIGH 7.8
Sources
- CVE-2023-32479 · CVE Program
- CVE-2023-32479 · NVD
- FIRST EPSS
- GHSA-whvw-59jf-hrx9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences