Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a improper verification of cryptographic signature in get applicable driver component. A local malicious user could potentially exploit this vulnerability leading to malicious payload execution.
Weakness
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Alienware_update | Dell | * | 4.7.1 (excluding) |
| Command_update | Dell | * | 4.7.1 (excluding) |
| Update | Dell | * | 4.7.1 (excluding) |