CVE-2019-3726
Quick assessment
Affected
Dell EMC Dell EMC Servers: Networking and Fibre Channel Drivers: Dell Update Package (DUP) Framework file
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Dell Update Package（DUP）Framework是美国戴尔（Dell）公司的一款用于更新系统组件的框架。该产品主要提供驱动程序、应用程序、BIOS和固件的安装程序。 Dell DUP Framework文件中存在代码问题漏洞。本地攻击者可通过诱使管理员运行可信的库，进而加载恶意的DLL利用该漏洞在用户系统上执行任意代码。以下产品及版本受到影响：Dell Update Package (DUP) Framework file 19.1.0.413版本（Dell EMC Servers），1
Possible ATT&CK Techniques 1 AI
T1574.002
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2019-3726
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file versions prior to 19.1.0.413, and Framework file versions prior to 103.4.6.69 used in Dell EMC Servers. Dell Update Package (DUP) Framework file versions prior to 3.8.3.67 used in Dell Client Platforms. The vulnerability is limited to the DUP framework during the time window when a DUP is being executed by an administrator. During this time window, a locally authenticated low privilege malicious user potentially could exploit this vulnerability by tricking an administrator into running a trusted binary, causing it to load a malicious DLL and allowing the attacker to execute arbitrary code on the victim system. The vulnerability does not affect the actual binary payload that the DUP delivers.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Dell Update Package Framework 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Dell Update Package（DUP）Framework是美国戴尔（Dell）公司的一款用于更新系统组件的框架。该产品主要提供驱动程序、应用程序、BIOS和固件的安装程序。 Dell DUP Framework文件中存在代码问题漏洞。本地攻击者可通过诱使管理员运行可信的库，进而加载恶意的DLL利用该漏洞在用户系统上执行任意代码。以下产品及版本受到影响：Dell Update Package (DUP) Framework file 19.1.0.413版本（Dell EMC Servers），1
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Dell EMC | Dell EMC Servers: Networking and Fibre Channel Drivers: Dell Update Package (DUP) Framework file | unspecified ~ 103.4.6.69 | - |
|
| Dell EMC | Dell EMC Servers: all other Drivers, BIOS and Firmware: Dell Update Package (DUP) Framework file | unspecified ~ 19.1.0.413 | - |
|
| Dell | Dell Client Platforms: Dell Update Packages (DUP) Framework file | unspecified ~ 3.8.3.67 | - |
|
II. Public POCs for CVE-2019-3726
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-3726
请登录查看更多情报信息。
Other References for CVE-2019-3726 (1)
-
https://www.dell.com/support/article/SLN318693 x_refsource_CONFIRM