Dell Command | Configure before version 5.2.3.35 contains an improper handling of mixed encoding bug that allows an unauthenticated attacker with remote access to potentially gain elevated privileges. The flaw arises from a failure to properly interpret input data that uses both ASCII and Unicode characters, leading the software to execute commands or elevate its permissions. The consequence is that a remote attacker could execute privileged code or bypass authentication on the affected host, compromising confidentiality, integrity, or availability of the system.

Managed systems running Dell Command | Configure versions older than 5.2.3.35 are impacted. No specific sub‑version range other than those preceding 5.2.3.35 is listed, so all releases prior to that safe version should be considered vulnerable.

The CVSS score of 7.4 classifies the issue as high severity, and the lack of a publicly available EPSS score indicates that an exact probability of exploitation is unknown, though the vulnerability is likely usable by attackers. Because the attack requires remote access and no authentication, the threat model targets environments with exposed DCC services. The vulnerability is currently not included in the CISA KEV catalog, so it is not known to be actively exploited at scale. Nevertheless, the remote unauthenticated nature and high impact recommend addressing it promptly.