The Dell Update Package Framework contains an improper handling of insufficient permissions or privileges that can be abused to elevate a low privileged local attacker to higher system rights. The weakness allows a local user with limited rights to bypass security checks when executing the framework, which is classified as CWE-280. Unchecked privileges can lead to full system compromise and unrestricted access to data and services.

Dell Update Package (DUP) Framework; versions 23.12.00 through 24.12.00 are affected. These versions are used in Dell systems to apply firmware and driver updates. The issue does not appear in earlier or later releases not listed here.

The vulnerability has a CVSS score of 8.2 indicating a high severity impact. However, the EPSS score is below 1%, suggesting that exploitation is unlikely in the wild at this time. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The attack vector is inferred to be local, requiring an attacker to have some level of local access but not administrative rights. Once the local user exploits the permission flaw, they can gain elevated privileges and potentially gain full control of the affected system.