« Volver al listado

CVE-2023-28071

Estado: ModificadaAlta (7.1)—

Dell Command | Update, Dell Update, and Alienware Update versions 4.9.0, A01 and prior contain an Insecure Operation on Windows Junction / Mount Point vulnerability. A local malicious user could potentially exploit this vulnerability to create arbitrary folder leading to permanent Denial of Service (DOS).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Dell — Alienware UpdateDell — Command UpdateDell — Update

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-28071",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-28071",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-07T20:53:10.318356Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security_alert@emc.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Dell",
          "product": "Dell Command Update (DCU)",
          "versions": [
            {
              "status": "affected",
              "version": "4.9.0, A01 and Prior"
            }
          ],
          "platforms": [
            "Dell Command | Update",
            "Dell Update /\r\nAlienware Update"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-06-23T11:15:09.790",
  "references": [
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000213546/dsa-2023-170-dell-command-update",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000213546/dsa-2023-170-dell-command-update",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security_alert@emc.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1386"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "\nDell Command | Update, Dell Update, and Alienware Update versions 4.9.0, A01 and prior contain an Insecure Operation on Windows Junction / Mount Point vulnerability. A local malicious user could potentially exploit this vulnerability to create arbitrary folder leading to permanent Denial of Service (DOS).\n\n"
    }
  ],
  "lastModified": "2026-06-17T05:46:47.623",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dell:alienware_update:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F463164D-6ADE-403A-A2A2-59FA7D63124C",
              "versionEndExcluding": "4.9.0"
            },
            {
              "criteria": "cpe:2.3:a:dell:alienware_update:4.9.0:a01:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98D0EE85-54B8-4BEC-BFD9-2D21659E739C"
            },
            {
              "criteria": "cpe:2.3:a:dell:command_update:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56815685-98A6-440A-888C-C7AD5A80BDCA",
              "versionEndExcluding": "4.9.0"
            },
            {
              "criteria": "cpe:2.3:a:dell:command_update:4.9.0:a01:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "140B3324-4186-487C-B37E-322C132B6F33"
            },
            {
              "criteria": "cpe:2.3:a:dell:update:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79DCD0C0-ED30-46D7-AF60-13BD62747219",
              "versionEndExcluding": "4.9.0"
            },
            {
              "criteria": "cpe:2.3:a:dell:update:4.9.0:a01:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E298A8B7-0700-42A0-8730-1B77163CF877"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}