Dell Command | Intel vPro Out of Band versions earlier than 4.7.0 suffer from an uncontrolled search path element vulnerability (CWE‑427). The flaw allows a local attacker with limited privileges to influence the search path used by the software, potentially enabling the execution of malicious code under higher authority. Exploitation would result in local privilege escalation, granting the attacker greater access to system resources.

The issue affects Dell Command | Intel vPro Out of Band on Dell systems, specifically all releases earlier than version 4.7.0. The vulnerability is tied to the component that processes the PATH variable during operation, and the affected binaries are distributed with the Dell Command product suite.

The CVSS score of 8.8 indicates a high severity, while the EPSS of less than 1 % suggests low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly known exploitable variants have been reported. An attacker must have physical or local administrative access, so the attack vector is local. If the software remains unpatched, a local user could bypass restrictions, gaining elevated privileges and potentially accessing or modifying sensitive data.