Dell Update Package Framework

CVE-2025-22395 is a local privilege-escalation flaw in Dell Update Package (DUP) Framework affecting versions before 22.01.02. Dell says a local low-privileged attacker can abuse the framework and reach arbitrary remote script execution on the server, with possible denial of service. The advisory and workaround strongly narrow the path: the risk is tied to Microsoft Windows use of the DUP Extract option in vulnerable package files, while Dell explicitly says to avoid that workflow and use command-line extraction instead until updated.

Dell's 8.2/HIGH score overstates enterprise urgency because it prices in full impact after compromise, not the friction before compromise. This is not an unauthenticated remote bug, not an internet-facing service bug, and not a broad wormable update agent flaw; it is a post-initial-access, local, user-interaction-dependent abuse case in a maintenance utility that many servers will only touch during update workflows. The impact is real once an attacker is already on the box, but the reachable population is much smaller than the CVSS headline implies.

Why this verdict

• Start from vendor 8.2, then cut hard for attacker position: AV:L + PR:L means the attacker already has a foothold on the box. For a 10,000-host estate, that is not patch-everything-now territory by itself.
• Cut again for reachability: Dell's workaround specifically calls out the Windows Extract option on vulnerable package files. That implies the dangerous path is not the default exposure model for every system merely running Dell hardware.
• Cut again for population size: DUP is an update package/executable used in maintenance workflows, not a permanently exposed service. Internet-facing reach is effectively nil, and many hosts will never execute the vulnerable path.
• Cut a little back up for impact: if the path is reachable, a low-privileged user can turn that into elevated execution on a server. Host compromise impact is real, especially on management or admin-jump systems.
• No exploitation amplifier: no KEV listing, no authoritative in-the-wild reporting, and no public exploit tooling were found. That removes the strongest reasons to stay in HIGH.

Why not higher?

This is not remotely reachable, not unauthenticated, and not broad-spectrum across all Dell operations. The chain requires local access, low privileges, and apparently a specific interactive Windows extraction workflow, which compounds the friction and materially limits the exposed population.

Why not lower?

Once an attacker is already on the host, this can still become a real privilege-escalation event with full host impact. On sensitive servers or management nodes, host-local LPEs are never free: they can break containment, defeat least privilege, and turn a small foothold into durable control.

1. Block vulnerable DUP execution from user-writeable paths — Use AppLocker, WDAC, or equivalent allowlisting so Dell update executables cannot be launched from %TEMP%, %USERPROFILE%, downloads, or ad hoc admin shares. This narrows the reachable path immediately; for a MEDIUM verdict there is no mitigation SLA, but this is still worth doing on admin workstations and server maintenance jump boxes before the 365-day remediation window closes.
2. Ban the Windows GUI Extract workflow for old DUPs — Until all staged packages are at 22.01.02+, standardize on Dell's safer workaround: do not use the Windows Extract option on vulnerable package versions, and use approved command-line methods instead. This directly suppresses the path Dell itself identified; for MEDIUM, there is no mitigation SLA, so prioritize it where Dell package handling is common.
3. Purge old DUP packages from repositories and shares — Search software shares, SCCM/ConfigMgr content libraries, Intune package sources, golden images, and admin toolkits for DUP files with version below 22.01.02 and remove them. This reduces accidental reachability and cuts the attack surface at scale before patching every endpoint.
4. Hunt for updater-child-process abuse — Create detections for Dell update executables spawning powershell.exe, cmd.exe, wscript.exe, or other script engines, especially from user-writeable extraction folders. This is the best operational tripwire because exploit behavior is more visible than the underlying flaw.
5. Tighten local admin and interactive logon rights — Because the vulnerability is local and post-compromise, reducing who can log on interactively to servers and who can stage packages locally meaningfully lowers risk. Focus first on jump boxes, management servers, and shared admin endpoints.

Run this on the target Windows host, on a package repository share, or from an auditor workstation that can read the relevant files. Invoke it with powershell -ExecutionPolicy Bypass -File .\Test-DellDUP-CVE-2025-22395.ps1 -Path 'C:\Temp\DellPackages' or point -Path at a single DUP .exe; administrator rights are not required for read-only checks, but you need file-system access to the target path.

# Test-DellDUP-CVE-2025-22395.ps1

# Checks Dell Update Package (DUP) executables for vulnerable framework versions prior to 22.01.02.

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


[CmdletBinding()]
param(
    [Parameter(Mandatory=$true)]
    [string]$Path
)

function Convert-ToVersion {
    param([string]$Value)
    if ([string]::IsNullOrWhiteSpace($Value)) { return $null }

    # Extract the first numeric version-looking token, e.g. 22.01.02 or 22.01.02.00

    $m = [regex]::Match($Value, '(\d+)(\.\d+){1,3}')
    if (-not $m.Success) { return $null }

    $parts = $m.Value.Split('.')
    while ($parts.Count -lt 4) { $parts += '0' }
    try {
        return [version]::new([int]$parts[0],[int]$parts[1],[int]$parts[2],[int]$parts[3])
    } catch {
        return $null
    }
}

$fixed = [version]'22.1.2.0'
$results = @()

try {
    if (-not (Test-Path -LiteralPath $Path)) {
        Write-Output 'UNKNOWN - path not found'
        exit 2
    }

    $item = Get-Item -LiteralPath $Path -ErrorAction Stop
    if ($item.PSIsContainer) {
        $files = Get-ChildItem -LiteralPath $Path -Recurse -File -Include *.exe -ErrorAction SilentlyContinue
    } else {
        $files = @($item)
    }

    foreach ($file in $files) {
        try {
            $vi = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($file.FullName)
            $productName = $vi.ProductName
            $desc = $vi.FileDescription
            $fileVersionRaw = $vi.FileVersion
            $productVersionRaw = $vi.ProductVersion

            $isDellDup = $false
            if ($productName -match 'Dell Update Package' -or $desc -match 'Dell Update Package' -or $file.Name -match '^[A-Z0-9_\-]+_A\d+.*\.exe$') {
                $isDellDup = $true
            }

            if (-not $isDellDup) { continue }

            $ver = Convert-ToVersion $productVersionRaw
            if (-not $ver) { $ver = Convert-ToVersion $fileVersionRaw }

            if (-not $ver) {
                $results += [pscustomobject]@{
                    Path = $file.FullName
                    Version = ($productVersionRaw, $fileVersionRaw -ne $null ? $productVersionRaw : $fileVersionRaw) -join ' '
                    Status = 'UNKNOWN'
                    Reason = 'Could not parse version'
                }
                continue
            }

            if ($ver -lt $fixed) {
                $results += [pscustomobject]@{
                    Path = $file.FullName
                    Version = $ver.ToString()
                    Status = 'VULNERABLE'
                    Reason = 'Version is prior to 22.01.02'
                }
            } else {
                $results += [pscustomobject]@{
                    Path = $file.FullName
                    Version = $ver.ToString()
                    Status = 'PATCHED'
                    Reason = 'Version is 22.01.02 or later'
                }
            }
        } catch {
            $results += [pscustomobject]@{
                Path = $file.FullName
                Version = ''
                Status = 'UNKNOWN'
                Reason = $_.Exception.Message
            }
        }
    }

    if (-not $results -or $results.Count -eq 0) {
        Write-Output 'UNKNOWN - no candidate Dell DUP executables found at the supplied path'
        exit 2
    }

    $results | Sort-Object Status, Path | Format-Table -AutoSize | Out-String | Write-Output

    if ($results.Status -contains 'VULNERABLE') {
        Write-Output 'VULNERABLE'
        exit 1
    }

    if ($results.Status -contains 'PATCHED' -and -not ($results.Status -contains 'VULNERABLE')) {
        Write-Output 'PATCHED'
        exit 0
    }

    Write-Output 'UNKNOWN'
    exit 2
} catch {
    Write-Output ('UNKNOWN - ' + $_.Exception.Message)
    exit 2
}

Sources

1. Dell advisory DSA-2025-034
2. NVD CVE-2025-22395
3. Dell Update Packages 22.01.00 User's Guide - Getting Started
4. Dell Update Packages 22.01.00 User's Guide - Windows CLI options
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS overview
7. OSV entry mirroring CVE publication metadata