CVE-2025-22395
Published: 07 January 2025
Description
Dell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary remote scripts on the server. Exploitation may lead to a denial of service by an attacker.
Security Summary
CVE-2025-22395 is a local privilege escalation vulnerability affecting the Dell Update Package (DUP) Framework in versions prior to 22.01.02. The flaw, associated with CWE-280 (improper handling of insufficient privileges), allows escalation from low-privileged access and was published on January 7, 2025, with a CVSS v3.1 base score of 8.2 (AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability by tricking a user into interacting with a malicious input, potentially leading to the execution of arbitrary remote scripts on the server. Successful exploitation enables high-impact confidentiality, integrity, and availability violations, including denial of service.
Dell's security advisory (DSA-2025-034) at https://www.dell.com/support/kbdoc/en-us/000269079/dsa-2025-034-security-update-for-dell-update-package-dup-framework-vulnerability recommends updating the DUP Framework to version 22.01.02 or later to mitigate the issue.
Details
- CWE(s)