Dell Command Update contains a Time‑of‑check Time‑of‑use race condition that can allow a local, low‑privileged user to elevate privileges. An attacker who can initiate the vulnerable operation on a host running an affected version can manipulate the timing of file or value checks to cause the program to act on a malicious or altered resource, thereby violating the intended privilege boundary. The core weakness is a race condition, classified as CWE‑367, that directly undermines the integrity of privilege checks within the updater.

The vulnerability affects Dell Command Update (DCU) installations with a version earlier than 5.7.1 on any operating system compatible with the tool. Users of DCU should verify that their deployments are running 5.7.1 or a later release to avoid this flaw.

The vulnerability scores a CVSS of 7.8, indicating high severity for local exploitation. The EPSS score of 0.00084 (0.08%) shows an extremely low likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog, yet it still poses a significant risk for environments that allow local users to run DCU operations. Because the attack requires local access and low privilege, the attack surface is limited to physically or logically accessible systems. However, if such access is obtained, an attacker can gain elevated rights, potentially compromising the entire host.