CVE-2026-24502:

Dell Command | Intel vPro Out of Band versions prior to 4.7.0 contain an Uncontrolled Search Path Element vulnerability allowing local privilege escalation.

Score
A numerical rating that indicates how dangerous this vulnerability is.

8.8High

Published Date:Mar 3, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Exploitability

Score:2.0
Attack Vector:LOCAL
Attack Complexity:LOW
Privileges Required:LOW
User Interaction:NONE
Scope:CHANGED

Impact

Score:6.0
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Dell Command | Intel vPro Out of Band versions prior to 4.7.0 contain an Uncontrolled Search Path Element vulnerability allowing local privilege escalation.

Overview

The vulnerability in Dell Command | Intel vPro Out of Band affects versions earlier than 4.7.0. It is characterized by an Uncontrolled Search Path Element, which can be exploited by a low-privileged attacker with local access. The potential impact of successful exploitation is severe, as it could lead to privilege escalation. The vulnerability has been assigned a CVSS v3.1 base score of 8.8, indicating a high severity level. The attack vector is local, with low attack complexity and low privileges required. No user interaction is necessary for exploitation. The scope is changed, and the impact on confidentiality, integrity, and availability is high across all three categories.

Remediation

To address this vulnerability, it is strongly recommended that users and administrators upgrade Dell Command | Intel vPro Out of Band to version 4.7.0 or later. This version contains the necessary fixes to mitigate the Uncontrolled Search Path Element vulnerability. In addition to upgrading, it is advisable to implement the principle of least privilege, regularly monitor system activities, and maintain up-to-date security patches for all software components. Organizations should also consider implementing additional security measures such as access controls and network segmentation to minimize the potential impact of successful exploits.