PT-2025-4488 · Dell · Dell Update Package (Dup) Framework

Published 2025-01-07 · Updated 2025-01-16 · CVE-2025-22395

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell Update Package Framework versions prior to 22.01.02

Description A local low privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary remote scripts on the server. Exploitation may lead to a denial of service by an attacker. This issue allows for local privilege escalation.

Recommendations For Dell Update Package Framework versions prior to 22.01.02, update to version 22.01.02 or later to resolve the issue. As a temporary workaround, consider restricting access to the server to minimize the risk of exploitation. Avoid executing arbitrary remote scripts on the server until the issue is resolved.

Fix

LPE

Weakness Enumeration

CWE-280

Related Identifiers

CVE-2025-22395

Affected Products

Dell Update Package (Dup) Framework

References · 12

• https://osv.dev/vulnerability/CVE-2025-22395 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22395 · Security Note
• https://dell.com/support/kbdoc/en-us/000269079/dsa-2025-034-security-update-for-dell-update-package-dup-framework-vulnerability · Vendor Advisory
• https://twitter.com/vuldb/status/1876680959191626034 · Twitter Post
• https://t.me/latest_high_impact_cve/1749 · Telegram Post
• https://twitter.com/CVEnew/status/1876465061528563823 · Twitter Post
• https://t.me/cvedetector/14427 · Telegram Post
• https://t.me/cvenotify/106487 · Telegram Post
• https://twitter.com/TMJIntel/status/1879969372304773330 · Twitter Post
• https://twitter.com/cracbot/status/1878321067502260504 · Twitter Post
• https://t.me/thedarkwebinformer/10101 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1876477975689941173 · Twitter Post