Technical impact
Dell AppSync 4.6.0 contains an incorrect permission assignment that permits a low‑privileged local user to gain administrative privileges. The flaw, identified as CWE-732, enables the attacker to alter system configuration, modify or delete data, and install malicious software, thereby compromising the system’s integrity and confidentiality.
Affected Systems
The product impacted by this vulnerability is Dell AppSync version 4.6.0. No other versions are presently reported as affected. Users executing this specific version should verify that they have applied the latest Dell-provided patch before continuing.
Risk and Exploitability
This vulnerability receives a CVSS score of 7.3, indicating high severity, while the EPSS score is below 1%, suggesting a low likelihood of exploitation. It is not listed in the CISA KEV catalog. Successful exploitation requires local access and a low‑privileged account, implying that the attack vector is local. The attacker can achieve privilege escalation by exploiting the misassigned permissions of a critical resource without needing additional software or advanced techniques.
