CVE-2023-43086
📋 TL;DR
Dell Command | Configure versions before 4.11.0 have an improper access control vulnerability that allows local malicious users to modify files during application upgrades. This can lead to privilege escalation on affected systems. Only users with local access to vulnerable systems are affected.
💻 Affected Systems
- Dell Command | Configure
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains SYSTEM/root privileges, enabling complete system compromise, data theft, persistence, and lateral movement.
Likely Case
Local user elevates privileges to install malware, modify system configurations, or access restricted data.
If Mitigated
Attack fails due to proper access controls, monitoring, or the system being patched.
🎯 Exploit Status
Exploitation requires local access and knowledge of the vulnerability during upgrade processes.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.11.0 or later
Vendor Advisory: https://www.dell.com/support/kbdoc/en-us/000218424/dsa-2023-387-security-update-for-a-dell-command-configure-vulnerability
Restart Required: Yes
Instructions:
1. Download Dell Command | Configure version 4.11.0 or later from Dell Support. 2. Run the installer as administrator. 3. Follow on-screen instructions. 4. Restart the system when prompted.
🔧 Temporary Workarounds
Restrict local access
windowsLimit local user access to systems running vulnerable versions.
Monitor installation folder permissions
windowsSet strict permissions on Dell Command | Configure installation folder and monitor for changes.
icacls "C:\Program Files\Dell\CommandConfigure" /deny Users:(OI)(CI)F
🧯 If You Can't Patch
- Remove Dell Command | Configure if not required for system functionality.
- Implement strict access controls and monitoring for local user activities.
🔍 How to Verify
Check if Vulnerable:
Check Dell Command | Configure version in Programs and Features or via 'wmic product get name,version' command.Check Version:
wmic product where "name like 'Dell Command%Configure%'" get name,versionVerify Fix Applied:
Verify installed version is 4.11.0 or later using same method as checking.📡 Detection & Monitoring
Log Indicators:
- Unauthorized file modifications in Dell Command | Configure installation directory during upgrade events
- Unexpected privilege escalation events from standard user accounts
Network Indicators:
- No network indicators - this is a local attack
SIEM Query:
EventID=4688 AND (ProcessName LIKE '%CommandConfigure%' OR CommandLine LIKE '%CommandConfigure%') AND NewProcessName LIKE '%powershell%' OR NewProcessName LIKE '%cmd%'