Dell Update Package Framework 19.1.0.413 insufficient permissions or privileges

Summaryinfo

A vulnerability marked as critical has been reported in Dell Update Package Framework. Impacted is an unknown function. Performing a manipulation results in insufficient permissions or privileges. This vulnerability is reported as CVE-2025-22395. The attack requires a local approach. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Dell Update Package Framework. It has been classified as critical. This affects an unknown code. The manipulation with an unknown input leads to a insufficient permissions or privileges vulnerability. CWE is classifying the issue as CWE-280. The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Dell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary remote scripts on the server. Exploitation may lead to a denial of service by an attacker.

It is possible to read the advisory at dell.com. This vulnerability is uniquely identified as CVE-2025-22395 since 01/06/2025. The exploitability is told to be easy. Attacking locally is a requirement. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/07/2025). The attack technique deployed by this issue is T1222 according to MITRE ATT&CK.

Upgrading to version 22.01.02 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Dell

Name

• Update Package Framework

Version

• 19.1.0.413

License

• commercial

Website

• Vendor: https://www.dell.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion