Dell Repository Manager (DRM) versions earlier than 3.4.8 contain an uncontrolled search path element flaw. The vulnerability permits a locally privileged attacker to insert malicious entries into the system's search path, enabling the execution of arbitrary code with elevated privileges. This can lead to full system compromise and unauthorized data access.

The issue affects Dell Repository Manager deployments running any version prior to 3.4.8. The specific product is Dell Repository Manager available on Dell platforms.

The CVSS score is 7.3, indicating a high severity, while the EPSS score is below 1%, suggesting exploit probability is low at present. The vulnerability is not listed in the CISA KEV catalog. A local attacker with limited system permissions is required; the attack is opportunistic and depends on the ability to alter environment path variables on the host. Once exploited, the attacker can gain the same privileges as the service process, resulting in full control over the host.