CVE-2026-67268: XEE
Dell Command Update (DCU), versions prior to 5.7.1, contain an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges and Server-side request forgery.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dell Command Update (DCU)to a version that resolves this vulnerability.Fixed in 5.7.1 - Compensating control
Since the issue is Improper Restriction of XML External Entity Reference, restrict local access to Dell Command Update (DCU) so a low-privileged attacker cannot provide or influence crafted XML inputs.
Event History
Frequently Asked Questions
Who is realistically exposed to this vulnerability?
Systems running Dell Command Update versions earlier than 5.7.1 are affected. Exploitation requires local access and a low-privileged attacker account; it is not described as remotely exploitable without local access.
What could an attacker achieve?
A low-privileged local attacker could potentially exploit the XML external entity issue to elevate privileges and perform server-side request forgery.
What version should be deployed to remediate the issue?
Update Dell Command Update to version 5.7.1 or later. The vulnerability affects versions prior to 5.7.1.