CVE-2023-39254 is a Medium severity (CVSS 6.7) uncontrolled search path flaw in Dell Update Package (DUP) framework versions before 4.9.10. A local user could run arbitrary code as an administrator. Update to DUP framework 4.9.10 or later, as listed in the record and Dell bulletin DSA-2023-338.
What's affected
The record says Dell Update Package versions prior to 4.9.10 are affected, which makes 4.9.10 the first fixed version according to the record. Dell's bulletin, DSA-2023-338, is the source for that; Dell's support site blocked automated access when this post was reviewed, so we could not read it ourselves. Confirm the fixed version and the list of affected packages in the bulletin.
A DUP is the self-contained executable that Dell distributes to update drivers, BIOS and firmware on Windows systems. Because every update package embeds the DUP framework, the affected population is any machine where an older package is run. Old packages saved on shared drives or in deployment tools are an easy thing to miss.
The attack needs local access, a low-privilege account and some user interaction, and its complexity is rated high. That is why the score stays at 6.7.
How to check if you're exposed
Inventory the Dell update packages you keep and run. Look in software deployment shares, patch management tools and the download folders of administrators. For each package, find the framework version Dell lists in its release information, and compare to 4.9.10.
Also check the folders from which update packages get run. The weakness is about the order in which a program looks for files to load, so a package launched from a folder that ordinary users can write to is the situation to avoid. On Windows, you can list folder permissions with:
icacls "D:\path\to\update-share"
Substitute your own path, and look for write access granted to Users or Everyone.
What to do now
- Find the Dell Update Package files stored in your deployment tools and shares, and note which ones embed a framework older than 4.9.10.
- Replace them with current packages from Dell that include DUP framework 4.9.10 or later, and delete the old copies.
- Read DSA-2023-338 and confirm the fixed versions it lists.
- Run update packages only from folders where ordinary users have no write access.
- Where practical, run firmware updates through your managed deployment tooling, and not by hand from user-writable folders.
Why it matters
The weakness is CWE-427 (uncontrolled search path element). When a program that runs with high privileges loads a file by name and searches several folders in order, an attacker who can place a file with that name in an earlier folder gets their file loaded instead. The code then runs with the same privileges as the update, which is administrator level.
It is a local privilege escalation. It does not give anyone a way in from the network, but it turns a standard user account into an administrator on a machine where an update is run. That is worth closing in environments with shared workstations, kiosks and lab machines. The record does not mark the CVE as exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Which version fixes this?
The record says versions before 4.9.10 are affected, so 4.9.10 or later. Confirm in Dell's bulletin DSA-2023-338.
Can this be exploited remotely?
Not directly. The vector is local: the attacker needs access to the machine and the update has to be run. It is an escalation of privilege, not a remote entry point.
Sources
- Dell DSA-2023-338: security update for the DUP framework (listed in the record; blocked from automated access when reviewed)
- Record data for CVE-2023-39254
Last reviewed: 19 October 2026.
