CVE-2019-3726
An Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file versions prior to…
- Published
- Updated
- Reserved
- Assigned by
- dell
Description
An Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file versions prior to 19.1.0.413, and Framework file versions prior to 103.4.6.69 used in Dell EMC Servers. Dell Update Package (DUP) Framework file versions prior to 3.8.3.67 used in Dell Client Platforms. The vulnerability is limited to the DUP framework during the time window when a DUP is being executed by an administrator. During this time window, a locally authenticated low privilege malicious user potentially could exploit this vulnerability by tricking an administrator into running a trusted binary, causing it to load a malicious DLL and allowing the attacker to execute arbitrary code on the victim system. The vulnerability does not affect the actual binary payload that the DUP delivers.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| dellCNA (assigner) | 3.0 | Medium6.7 | CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Medium6.7 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.46% · top 60% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.7.
Weakness
- Uncontrolled Search Path Vulnerability
- CWE-427 (opens in a new tab)All about CWE-427 and its CVEs
Affected products
Dell EMC · Dell EMC Servers: Networking and Fibre Channel Drivers: Dell Update Package (DUP) Framework file
- affected unspecified – < 103.4.6.69
Dell EMC · Dell EMC Servers: all other Drivers, BIOS and Firmware: Dell Update Package (DUP) Framework file
- affected unspecified – < 19.1.0.413
Dell · Dell Client Platforms: Dell Update Packages (DUP) Framework file
- affected unspecified – < 3.8.3.67
References (1)
- https://www.dell.com/support/article/SLN318693 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2019-3726)Record last updated .